Executive brief
NLnet Labs Unbound, a widely used tool for translating human-readable web addresses into computer-readable IP addresses, is vulnerable to cache poisoning. An attacker can trick the system into storing incorrect information by sending specially crafted network packets. This could allow an attacker to redirect internet traffic to malicious servers, potentially leading to data theft or service disruption.
Technical details
Unbound up to version 1.25.0 is vulnerable to DNS cache poisoning due to improper validation of RRSets in the authority section of DNS replies. An attacker can exploit this by injecting non-NS records (such as MX records) accompanied by address records in the additional section. If the attacker successfully spoofs a reply or utilizes fragmentation attacks, Unbound may accept and cache these irrelevant address records if the authority RRSet has sufficient trust (in-zone data). This vulnerability is a complement to CVE-2025-11411. Version 1.25.1 mitigates this by disregarding address records in the additional section that are not explicitly relevant to authority NS records.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: advisory: NVD publication date
- 2026-05-20: patched: Unbound 1.25.1 released with fix