Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

...

CVE-2026-44687

CVE-2026-44687 affects NLnet Labs Unbound releases 1.13.2 through 1.25.1. A bug in the default tallied logic for hardened-below-nxdomain can cause a stub or forward zone to be shadowed by a DNSSEC-secure NXDOMAIN answer at the parent when the query name is an intermediate label below a signed zon...