Skip to content

CVE-2026-44690 (High) detected in multiple libraries #470

Open
Open
CVE-2026-44690 (High) detected in multiple libraries#470
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

Description

@mend-bolt-for-github
mend-bolt-for-github
bot
opened on Jul 23, 2026

CVE-2026-44690 - High Severity Vulnerability

Vulnerable Libraries - freebsd-srcrelease/15.0.0-p7, freebsd-srcrelease/15.0.0-p7, freebsd-srcrelease/15.0.0-p7, freebsd-srcrelease/15.0.0-p7, freebsd-srcrelease/15.0.0-p7

freebsd-srcrelease/15.0.0-p7

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Vulnerable Source Files (5)

/contrib/unbound/validator/validator.c
/contrib/unbound/services/cache/rrset.c
/contrib/unbound/validator/val_sigcrypt.c
/contrib/unbound/validator/val_utils.h
/contrib/unbound/validator/val_utils.c

freebsd-srcrelease/15.0.0-p7

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Vulnerable Source Files (5)

/contrib/unbound/validator/validator.c
/contrib/unbound/services/cache/rrset.c
/contrib/unbound/validator/val_sigcrypt.c
/contrib/unbound/validator/val_utils.h
/contrib/unbound/validator/val_utils.c

freebsd-srcrelease/15.0.0-p7

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Vulnerable Source Files (5)

/contrib/unbound/validator/validator.c
/contrib/unbound/services/cache/rrset.c
/contrib/unbound/validator/val_sigcrypt.c
/contrib/unbound/validator/val_utils.h
/contrib/unbound/validator/val_utils.c

freebsd-srcrelease/15.0.0-p7

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Vulnerable Source Files (5)

/contrib/unbound/validator/validator.c
/contrib/unbound/services/cache/rrset.c
/contrib/unbound/validator/val_sigcrypt.c
/contrib/unbound/validator/val_utils.h
/contrib/unbound/validator/val_utils.c

freebsd-srcrelease/15.0.0-p7

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Vulnerable Source Files (5)

/contrib/unbound/validator/validator.c
/contrib/unbound/services/cache/rrset.c
/contrib/unbound/validator/val_sigcrypt.c
/contrib/unbound/validator/val_utils.h
/contrib/unbound/validator/val_utils.c

Found in base branches: stable/4.0, master

Vulnerability Details

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

Publish Date: 2026-07-22

URL: CVE-2026-44690

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

Activity

  1. mend-bolt-for-github
    added
    Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource
    on Jul 23, 2026
  2. mend-bolt-for-github
    changed the title [-]CVE-2026-44690 (High) detected in multiple libraries[/-] [+]CVE-2026-44690 (High) detected in multiple libraries - autoclosed[/+] on Sep 18, 2026
  3. mend-bolt-for-github
    closed this as completedon Sep 18, 2026

  4. mend-bolt-for-github commented on Sep 18, 2026

    @mend-bolt-for-github
    mend-bolt-for-githubbot
    on Sep 18, 2026 – with Mend Bolt for GitHub
    ContributorAuthor

    ✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

  5. mend-bolt-for-github commented on Sep 18, 2026

    @mend-bolt-for-github
    mend-bolt-for-githubbot
    on Sep 18, 2026 – with Mend Bolt for GitHub
    ContributorAuthor

    ✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

  6. mend-bolt-for-github
    changed the title [-]CVE-2026-44690 (High) detected in multiple libraries - autoclosed[/-] [+]CVE-2026-44690 (High) detected in multiple libraries[/+] on Oct 7, 2026
  7. mend-bolt-for-github
    reopened this on Oct 7, 2026

  8. mend-bolt-for-github commented on Oct 7, 2026

    @mend-bolt-for-github
    mend-bolt-for-githubbot
    on Oct 7, 2026 – with Mend Bolt for GitHub
    ContributorAuthor

    ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions