Resolver stacks buckle together under DNSSEC and transport CVEs

Three independent recursive resolver projects published security releases on the same July day, and the worst of the findings land on the same narrow ground. Unbound, BIND 9, and PowerDNS Recursor each shipped fixes for HIGH-severity problems in DNSSEC validation and cache behavior, several of them built around RRSIG label counts, wildcards, and proof handling. The coincidence is not a calendar accident. It is the public end of a coordinated embargo, and it leaves operators staring at a single uncomfortable fact: the code that is meant to guarantee DNS integrity is under simultaneous, systemic strain.

Yorgos Thessalonikefs announced Unbound 1.25.2 as a security release covering a long list of items, four of them rated HIGH. Among them sits CVE-2026-44690, described as "Cross-zone wildcard cache poisoning via RRSIG.labels manipulation." That wording is almost a mirror of language coming out of the other projects the same day. Michał Kępień's disclosure for ISC listed nine BIND 9 CVEs; one of them, CVE-2026-11721, is summarized as "Cache poisoning possible with label count discrepancy, RRSIG, and wildcards." Otto Moerbeek's PowerDNS advisory 2026-10 fixed two issues, the High one being CVE-2026-52688: "RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation." A second PowerDNS item, later corrected in numbering to CVE-2026-52686, covered a "Wildcard CNAME proof validation bypass."

The technical core is the same awkward corner of the DNSSEC specifications. Resolvers must decide whether a signature covers a name, a wildcard expansion, or neither, and the RRSIG labels field is part of that decision. Get the count wrong, accept an out-of-zone or under-labeled signature, or mishandle the interaction with NSEC or NSEC3 proofs, and an attacker can make a validator accept data it should reject or cache an answer that belongs to a different zone. BIND's batch also included CVE-2026-13321, a "DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field," and CVE-2026-10723 for "Incorrect acceptance of NSEC3 records," plus an unexpected-exit case when NSEC and NSEC3 appear together. Unbound and PowerDNS hit the wildcard and label path; BIND hit that path and the surrounding proof machinery. Independent codebases, same class of failure.

Maintainers present the wave as ordinary, careful process. Kępień's notice is explicit that "the embargo period is ended and any updated software packages that have been prepared may be released." Thessalonikefs simply states that "Several vulnerabilities were found in Unbound" and that 1.25.2 includes the relevant fixes. Moerbeek frames the PowerDNS work as a normal security advisory with one High and one Low CVE. On this view, coordinated disclosure did its job: researchers found residual bugs, vendors fixed them under embargo, and the public now receives patches together so that no one implementation is singled out as uniquely broken. The overlapping root causes are evidence that the research was thorough, not that the protocol is unimplementable.

The opposing reading is harder to dismiss after three projects fail the same exam. DNSSEC wildcard synthesis, negative proofs, and label arithmetic have been sources of interoperability and security trouble for years. When three mature resolvers all require emergency fixes for variants of the same logic error, the common mode looks less like a string of unlucky coding mistakes and more like a specification surface that continues to defeat careful engineering. Operators who run mixed fleets, or who rely on public resolvers built from these codebases, now face a patch window in which the integrity machinery itself is the unreliable component. The question is no longer whether any single vendor reviewed its validator; it is whether the edge cases around wildcards and RRSIGs are simply too intricate for the current generation of implementations to get consistently right.

The batches are not limited to DNSSEC. Unbound's HIGH list also carries a remote DNS-over-QUIC denial of service from a quic-size budget bypass and a "Packet of death for DNSCrypt over TCP," plus a stack buffer overflow when dns-error-reporting is enabled. Medium items include an assertion in libngtcp2 under high-concurrency QUIC load, a heap use-after-free on a DoT forwarding error path, and several ways BOGUS answers or attacker-supplied glue can force cache flushes or policy misbehavior. BIND adds potential memory use beyond configured limits, RPZ wildcard CNAME policy bypass, and multiple unexpected-exit paths tied to record ordering and private algorithms. The newer encrypted transports and the policy engines bolted onto resolvers are accumulating their own memory-safety and resource-exhaustion problems at the same moment the validation core is being patched.

That combination matters for anyone who treats the recursive resolver as the trust anchor for everything above it. A cache-poisoning or validation-bypass bug undermines the authenticity guarantees DNSSEC was deployed to provide. A QUIC or DNSCrypt packet-of-death undermines availability for clients that have been steered toward encrypted DNS. When both classes of bug ship in the same security releases, the resolver is under pressure from the classic protocol complexity and from the newer protocol surface at once.

Where the situation stands is straightforward and unfinished. Patches are public: Unbound 1.25.2, BIND 9.20.26 and 9.21.24, and PowerDNS Recursor 5.2.12, 5.3.9, and 5.4.4. The embargo is over; packages can move. What remains unresolved is whether this coordinated wave is the clearing of a long-standing backlog of DNSSEC edge cases or merely the latest visible slice of a deeper problem. Further audits focused on label counting, wildcard proofs, and NSEC/NSEC3 mixing may still surface variants. The cost of implementing the full DNSSEC validation state machine, while also absorbing QUIC, DNSCrypt, DoT, RPZ, and error-reporting features, is now visible in the CVE lists themselves. Operators must decide how quickly to roll the updates and whether their redundancy plans still hold when every major open-source recursive path has just demonstrated related failures. The protocol demands have not shrunk. The implementations have just shown, together, where they still bend.