CVE-2026-42960 Details
Description
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.
A cache poisoning vulnerability has been identified in NLnet Labs Unbound DNS resolver versions prior to and including 1.25.0. The issue arises from the handling of promiscuous resource record sets (RRSets) in the authority section of DNS replies. An adversary can exploit this vulnerability by injecting RRSets, such as MX records, that are accompanied by address records in the additional section. This can be done through spoofed reply packets or fragmentation attacks. Unbound may cache these injected records if the authority RRSets are deemed trustworthy, leading to potential misuse of the cached data.
Users can upgrade to Unbound version 1.25.1, which includes a fix for this vulnerability by disregarding irrelevant address records from the additional section. For those using Unbound 1.25.0, a manual patch is available and can be applied by following the provided instructions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nlnetlabs unbound | < 1.25.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 20, 2026 | New CVE Received | [email protected] |