DEBIAN-CVE-2026-35501

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-35501
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-35501.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-35501
Upstream
  • CVE-2026-35501
Published
2026-10-21T18:47:29Z
Modified
2026-10-22T05:00:10Z
Summary
[none]
Details

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.

References

Affected packages

Debian:12 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.17.1-2
1.17.1-2+deb12u1
1.17.1-2+deb12u2
1.17.1-2+deb12u3
1.17.1-2+deb12u4
1.17.1-2+loong64
1.18.0-1
1.18.0-2
1.19.1-1
1.19.2-1
1.20.0-1
1.21.1-1
1.22.0-1
1.22.0-2
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1
1.25.2-1
1.26.0-1
1.26.0-2
1.26.1-1
1.26.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-35501.json"

Debian:13 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22.0-2
1.22.0-2+deb13u1
1.22.0-2+deb13u2
1.22.0-2+deb13u3
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1
1.25.2-1
1.26.0-1
1.26.0-2
1.26.1-0+deb13u1
1.26.1-1
1.26.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-35501.json"

Debian:14 / unbound

Package

Name
unbound
Purl
pkg:deb/debian/unbound?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22.0-2
1.23.1-1
1.24.0-1
1.24.0-2
1.24.1-1
1.24.1-2
1.24.2-1
1.25.0-1
1.25.1-1
1.25.2-1
1.26.0-1
1.26.0-2
1.26.1-1
1.26.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-35501.json"