Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability in how it handles expired records could allow an attacker to trick the system into caching incorrect DNS information. This could lead to users being directed to the wrong destination for specific network requests, though the attack is complex to execute and requires specific configuration settings to be active.
Technical details
A vulnerability exists in Unbound's DNSSEC validation logic where a wildcard RRset can be briefly marked as 'secure' based solely on RRSIG validation before NSEC validation is completed. If the 'serve-expired' path is active, a race condition allows a separate thread to pick up this prematurely validated 'secure' status and store it in the cache. An attacker can exploit this by using a CNAME wrapper to point to a record adjacent to a wildcard in a DNSSEC-signed domain they control. By injecting a signed wildcard RRset without accompanying NSEC records during a resolution attempt for an expired record, the attacker can poison the cache with incorrect data. This issue is resolved in Unbound version 1.25.2 by ensuring wildcard records are not cached as secure until full NSEC proof is verified.
Affected products
- NLnet Labs Unbound 1.6.0 to 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in Unbound 1.25.2