From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:12:03 +0000 (+0200)
Subject: - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain'
X-Git-Tag: release-1.25.2~17
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=1e1940383ab5ee655fe7fac0da606fe59c76ce86;p=thirdparty%2Funbound.git

- Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain'
  logic can shadow a stub/forward zone by a legitimate parent's
  NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
---

diff --git a/services/cache/dns.c b/services/cache/dns.c
index f6ce272a5..98d07bc37 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -1065,7 +1065,7 @@ dns_cache_lookup(struct module_env* env,
 	if(env->cfg->harden_below_nxdomain) {
 		while(!dname_is_root(k.qname)) {
 			if(dpname && dpnamelen
-				&& !dname_subdomain_c(k.qname, dpname))
+				&& !dname_strict_subdomain_c(k.qname, dpname))
 				break; /* no synth nxdomain above the stub */
 			dname_remove_label(&k.qname, &k.qname_len);
 			h = query_info_hash(&k, flags);