get-trust-anchor

DNSSEC Trust Anchor Tool This tool fetches the current DNSSEC root trust anchor from IANA, cryptographically validates it, and writes out the root KSK Key Signing Key as DNSKEY and DS records. It requires Python 3.10+ and the OpenSSL command line tool. There are no other dependencies. How it work...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-6qrc-597p-mrp9. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-terrapod-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

CLSA-2026-1792810562 unbound: Fix of 6 CVEs

CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache Rebirthday attack - CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation ghost domain - CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus -...

SUSE CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

SUSE CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

Amazon Linux 2 : ca-certificates (ALAS-2026-4037)

The version of ca-certificates installed on the remote host is prior to 2025.2.76-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4037 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed t...

DEBIAN-CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

DEBIAN-CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

AZL-110531 CVE-2026-50106 affecting package unbound 1.26.1-1

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106 Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

EUVD-2026-107152

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

NLnet Labs Unbound (up to and including version 1.26.1 ) is vulnerable to a logic flaw in its DNS validator when configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone. If the zone's parent is provably insecure under the root chain, a malicious act...

CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

CVE-2026-35501 Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

EUVD-2026-107151

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...