This is a CWE-193, an off‑by‑one error, in Unbound’s ‘harden‑below‑nxdomain’ logic that allows a parent zone to supply a DNSSEC‑signed NXDOMAIN answer that shadows a configured stub or forward zone. Because the check incorrectly strips an extra label before verifying the delegation guard, the resolver can skip contacting the intended upstream for an intermediate label, treating the answer as authoritative. This bypasses the configured routing for private or internal zones, causing them to fail resolution or receive improper answers.

NLnet Labs Unbound versions from 1.13.2 up to and including 1.25.1 are impacted. The issue occurs when stub or forward zones are nested two or more labels beneath a DNSSEC‑signed parent zone, and the ‘harden‑below‑nxdomain’ feature is enabled (the default).

The CVSS score of 3.7 indicates low overall severity, and the vulnerability is not listed in CISA’s KEV catalog. Although EPSS score is <1%, the flaw can be triggered by sending a DNS query for the intermediate sub‑label on any machine that uses an affected Unbound instance, which may be reachable over the network. Attackers could force the server to return a forged NXDOMAIN and prevent configured zones from being consulted, leading to denial of resolution for internal services. The exploit is straightforward—no extra privileges are required—so the risk is moderate for exposed resolvers but low for isolated internal deployments.