Executive brief
Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A security flaw allows an attacker who owns a single domain to trick the resolver into storing false information about other, unrelated domains. This could allow attackers to redirect users to malicious websites or intercept traffic for domains they do not own.
Technical details
A cache poisoning vulnerability exists in Unbound's implementation of RFC 8198 (aggressive NSEC processing). The flaw stems from insufficient validation of the RRSIG.Labels field and premature cache writes before full validation is complete. An attacker controlling a delegated zone under an NSEC-signed parent (like a TLD) can provide fraudulent wildcard DS records with fewer labels than expected. This allows the attacker to bring non-existent delegations into 'insecure' existence and inject malicious records for sibling domains within the same parent zone. The issue is fixed in Unbound 1.25.2 by adding lower-bound checks on RRSIG labels and ensuring cache writes occur only after validation.
Affected products
- NLnet Labs Unbound 1.7.0 up to and including 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2