CVE-2025-11411 describes a vulnerability in NLnet Labs Unbound DNS resolver up to version 1.24.1 where unsolicited NS RRSets in the authority section of DNS replies can be accepted and used to update delegation information. This acceptance of extraneous untrusted data alongside trusted data (CWE-349) can lead to domain hijacking by poisoning the resolver's knowledge of zone name servers. The vulnerability can be exploited through spoofed packets or fragmentation attacks. Unbound 1.24.1 mitigates this by scrubbing unsolicited NS RRSets and their address records from replies, and 1.24.2 extends this mitigation to YXDOMAIN and non-referral nodata replies.

An attacker could manipulate DNS responses to inject malicious NS RRSets, causing the resolver to update its delegation information incorrectly. This can lead to domain hijacking, redirecting DNS queries to attacker-controlled name servers. The CVSS 4.0 score is 5.7 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, but high impact on integrity and availability.

Unbound versions 1.24.1 and later include fixes that scrub unsolicited NS RRSets and their address records from DNS replies, mitigating this vulnerability. Users should upgrade to version 1.24.2 or later to benefit from the additional fix covering YXDOMAIN and non-referral nodata replies. Patch status is confirmed by the vendor advisory embedded in the description. No further action is required beyond upgrading to these fixed versions.