# CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

CVE-2026-44690 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-44690, released July 28, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-44690
- Priority: High
- CVSS: 8.6 (Moderate)
- EPSS: 0.0015
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 22, 2026
- Weakness: Insufficient Verification of Data Authenticity
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44690

## Description

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libunbound8 Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [libunbound8 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libunbound8-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | libunbound8 Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.17 | [libunbound8 1.13.1-1ubuntu5.17](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libunbound8-1.13.1-1ubuntu5.17.md) | Sep 16, 2026 |
| Linux | libunbound8 Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.12 | [libunbound8 1.19.2-1ubuntu3.12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libunbound8-1.19.2-1ubuntu3.12.md) | Sep 16, 2026 |
| Linux | libunbound8 Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.4 | [libunbound8 1.24.2-1ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libunbound8-1.24.2-1ubuntu2.4.md) | Sep 16, 2026 |
| Linux | python-unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [python-unbound 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-unbound-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | python3-unbound RHEL 8 | 0:1.16.2-5.14.el8_10 | [RHSA-2026:55784](https://patchblox.com/security/data/fix/linux/rhsa-2026-55784.md) | Aug 19, 2026 |
| Linux | python3-unbound RHEL 9 | 0:1.24.2-3.el9_8.4 | [RHSA-2026:55841](https://patchblox.com/security/data/fix/linux/rhsa-2026-55841.md) | Aug 19, 2026 |
| Linux | python3-unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [python3-unbound 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-unbound-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | python3-unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.17 | [python3-unbound 1.13.1-1ubuntu5.17](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-unbound-1.13.1-1ubuntu5.17.md) | Sep 16, 2026 |
| Linux | python3-unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.12 | [python3-unbound 1.19.2-1ubuntu3.12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-unbound-1.19.2-1ubuntu3.12.md) | Sep 16, 2026 |
| Linux | python3-unbound Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.4 | [python3-unbound 1.24.2-1ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-unbound-1.24.2-1ubuntu2.4.md) | Sep 16, 2026 |
| Linux | python3-unbound almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | python3-unbound almalinux 8 | 1.16.2-5.14.el8_10 | [ALSA-2026:55784](https://patchblox.com/security/data/fix/linux/alsa-2026-55784.md) | Aug 17, 2026 |
| Linux | python3-unbound almalinux 9 | 1.24.2-3.el9_8.4 | [ALSA-2026:55841](https://patchblox.com/security/data/fix/linux/alsa-2026-55841.md) | Aug 17, 2026 |
| Linux | python3-unbound amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | python3-unbound ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | python3-unbound ol 8 | 0:1.16.2-5.14.el8_10 | [ELSA-2026-55784](https://patchblox.com/security/data/fix/linux/elsa-2026-55784.md) | Aug 17, 2026 |
| Linux | python3-unbound ol 9 | 0:1.24.2-3.el9_8.4 | [ELSA-2026-55841](https://patchblox.com/security/data/fix/linux/elsa-2026-55841.md) | Aug 17, 2026 |
| Linux | python3-unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound Debian 13.5 (trixie) | 1.26.1-0+deb13u1 | [DEBIAN-CVE-2026-44690](https://patchblox.com/security/data/fix/linux/debian-cve-2026-44690.md) | Jul 28, 2026 |
| Linux | unbound Debian 14 | 1.25.2-1 | [DEBIAN-CVE-2026-44690](https://patchblox.com/security/data/fix/linux/debian-cve-2026-44690.md) | Jul 28, 2026 |
| Linux | unbound RHEL 10 | 1.24.2-7.el10_2.4 | [RHSA-2026:55892](https://patchblox.com/security/data/fix/linux/rhsa-2026-55892.md) | Aug 18, 2026 |
| Linux | unbound RHEL 8 | 0:1.16.2-5.14.el8_10 | [RHSA-2026:55784](https://patchblox.com/security/data/fix/linux/rhsa-2026-55784.md) | Aug 19, 2026 |
| Linux | unbound RHEL 9 | 0:1.24.2-3.el9_8.4 | [RHSA-2026:55841](https://patchblox.com/security/data/fix/linux/rhsa-2026-55841.md) | Aug 19, 2026 |
| Linux | unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [unbound 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.17 | [unbound 1.13.1-1ubuntu5.17](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-1.13.1-1ubuntu5.17.md) | Sep 16, 2026 |
| Linux | unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.12 | [unbound 1.19.2-1ubuntu3.12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-1.19.2-1ubuntu3.12.md) | Sep 16, 2026 |
| Linux | unbound Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.4 | [unbound 1.24.2-1ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-1.24.2-1ubuntu2.4.md) | Sep 16, 2026 |
| Linux | unbound almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound almalinux 8 | 1.16.2-5.14.el8_10 | [ALSA-2026:55784](https://patchblox.com/security/data/fix/linux/alsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound almalinux 9 | 1.24.2-3.el9_8.4 | [ALSA-2026:55841](https://patchblox.com/security/data/fix/linux/alsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound ol 8 | 0:1.16.2-5.14.el8_10 | [ELSA-2026-55784](https://patchblox.com/security/data/fix/linux/elsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound ol 9 | 0:1.24.2-3.el9_8.4 | [ELSA-2026-55841](https://patchblox.com/security/data/fix/linux/elsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound opensuse-leap 16.0 | 1.25.2-160000.1.1 | [OPENSUSE-SU-2026:21550-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21550-1.md) | Aug 10, 2026 |
| Linux | unbound rocky 10 | 0:1.24.2-7.el10_2.4 | [RLSA-2026:55892](https://patchblox.com/security/data/fix/linux/rlsa-2026-55892.md) | Aug 18, 2026 |
| Linux | unbound rocky 8 | 0:1.16.2-5.14.el8_10 | [RLSA-2026:55784](https://patchblox.com/security/data/fix/linux/rlsa-2026-55784.md) | Aug 18, 2026 |
| Linux | unbound rocky 9 | 0:1.24.2-3.el9_8.4 | [RLSA-2026:55841](https://patchblox.com/security/data/fix/linux/rlsa-2026-55841.md) | Aug 18, 2026 |
| Linux | unbound sles 15.6 | 1.25.2-150600.23.19.1 | [SUSE-SU-2026:3885-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3885-1.md) | Aug 31, 2026 |
| Linux | unbound sles 15.7 | 1.25.2-150600.23.19.1 | [SUSE-SU-2026:3885-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3885-1.md) | Aug 31, 2026 |
| Linux | unbound sles 16.0 | 1.25.2-160000.1.1 | [SUSE-SU-2026:23226-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23226-1.md) | Aug 10, 2026 |
| Linux | unbound-anchor Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [unbound-anchor 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-anchor-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | unbound-anchor Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.17 | [unbound-anchor 1.13.1-1ubuntu5.17](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-anchor-1.13.1-1ubuntu5.17.md) | Sep 16, 2026 |
| Linux | unbound-anchor Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.12 | [unbound-anchor 1.19.2-1ubuntu3.12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-anchor-1.19.2-1ubuntu3.12.md) | Sep 16, 2026 |
| Linux | unbound-anchor Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.4 | [unbound-anchor 1.24.2-1ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-anchor-1.24.2-1ubuntu2.4.md) | Sep 16, 2026 |
| Linux | unbound-anchor almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-anchor amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-anchor ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-anchor-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-debugsource amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-devel RHEL 8 | 0:1.16.2-5.14.el8_10 | [RHSA-2026:55784](https://patchblox.com/security/data/fix/linux/rhsa-2026-55784.md) | Aug 19, 2026 |
| Linux | unbound-devel RHEL 9 | 0:1.24.2-3.el9_8.4 | [RHSA-2026:55841](https://patchblox.com/security/data/fix/linux/rhsa-2026-55841.md) | Aug 19, 2026 |
| Linux | unbound-devel almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-devel almalinux 8 | 1.16.2-5.14.el8_10 | [ALSA-2026:55784](https://patchblox.com/security/data/fix/linux/alsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound-devel almalinux 9 | 1.24.2-3.el9_8.4 | [ALSA-2026:55841](https://patchblox.com/security/data/fix/linux/alsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-devel amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-devel ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-devel ol 8 | 0:1.16.2-5.14.el8_10 | [ELSA-2026-55784](https://patchblox.com/security/data/fix/linux/elsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound-devel ol 9 | 0:1.24.2-3.el9_8.4 | [ELSA-2026-55841](https://patchblox.com/security/data/fix/linux/elsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-dracut RHEL 9 | 0:1.24.2-3.el9_8.4 | [RHSA-2026:55841](https://patchblox.com/security/data/fix/linux/rhsa-2026-55841.md) | Aug 19, 2026 |
| Linux | unbound-dracut almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-dracut almalinux 9 | 1.24.2-3.el9_8.4 | [ALSA-2026:55841](https://patchblox.com/security/data/fix/linux/alsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-dracut ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-dracut ol 9 | 0:1.24.2-3.el9_8.4 | [ELSA-2026-55841](https://patchblox.com/security/data/fix/linux/elsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-host Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.11+esm3 | [unbound-host 1.9.4-2ubuntu1.11+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-host-1.9.4-2ubuntu1.11-esm3.md) | Sep 16, 2026 |
| Linux | unbound-host Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.17 | [unbound-host 1.13.1-1ubuntu5.17](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-host-1.13.1-1ubuntu5.17.md) | Sep 16, 2026 |
| Linux | unbound-host Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.12 | [unbound-host 1.19.2-1ubuntu3.12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-host-1.19.2-1ubuntu3.12.md) | Sep 16, 2026 |
| Linux | unbound-host Ubuntu 26.04.1 LTS (resolute) | 1.24.2-1ubuntu2.4 | [unbound-host 1.24.2-1ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-unbound-host-1.24.2-1ubuntu2.4.md) | Sep 16, 2026 |
| Linux | unbound-libs RHEL 8 | 0:1.16.2-5.14.el8_10 | [RHSA-2026:55784](https://patchblox.com/security/data/fix/linux/rhsa-2026-55784.md) | Aug 19, 2026 |
| Linux | unbound-libs RHEL 9 | 0:1.24.2-3.el9_8.4 | [RHSA-2026:55841](https://patchblox.com/security/data/fix/linux/rhsa-2026-55841.md) | Aug 19, 2026 |
| Linux | unbound-libs almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-libs almalinux 8 | 1.16.2-5.14.el8_10 | [ALSA-2026:55784](https://patchblox.com/security/data/fix/linux/alsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound-libs almalinux 9 | 1.24.2-3.el9_8.4 | [ALSA-2026:55841](https://patchblox.com/security/data/fix/linux/alsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-libs amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-libs ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-libs ol 8 | 0:1.16.2-5.14.el8_10 | [ELSA-2026-55784](https://patchblox.com/security/data/fix/linux/elsa-2026-55784.md) | Aug 17, 2026 |
| Linux | unbound-libs ol 9 | 0:1.24.2-3.el9_8.4 | [ELSA-2026-55841](https://patchblox.com/security/data/fix/linux/elsa-2026-55841.md) | Aug 17, 2026 |
| Linux | unbound-libs-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-utils almalinux 10 | 1.24.2-7.el10_2.4 | [ALSA-2026:55892](https://patchblox.com/security/data/fix/linux/alsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-utils amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |
| Linux | unbound-utils ol 10 | 0:1.24.2-7.el10_2.4 | [ELSA-2026-55892](https://patchblox.com/security/data/fix/linux/elsa-2026-55892.md) | Aug 17, 2026 |
| Linux | unbound-utils-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.13 | [ALAS2023-2026-2033](https://patchblox.com/security/data/fix/linux/alas2023-2026-2033.md) | Aug 3, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.