CVE-2026-42960 describes a vulnerability in NLnet Labs Unbound DNS resolver up to version 1.25.0 where promiscuous RRSets in the authority section of DNS replies can be used to poison the cache. Specifically, Unbound may accept and cache address records from the additional section that are not explicitly tied to authority NS records if the authority RRSet is trusted. An attacker capable of spoofing DNS replies or exploiting fragmentation attacks can inject such records, leading to cache poisoning. The issue is addressed in Unbound 1.25.1 by ignoring irrelevant address records in the additional section, thus preventing this poisoning vector. This fix complements the prior patch for CVE-2025-11411.

Successful exploitation allows an attacker to poison the DNS cache of Unbound resolvers by injecting malicious resource records, potentially redirecting DNS queries to attacker-controlled addresses. This undermines DNS integrity and can facilitate further attacks relying on DNS spoofing. The CVSS score of 5.7 reflects a medium severity with partial exploitability requiring network access and no privileges. No known exploits are reported in the wild at this time.

Unbound version 1.25.1 contains an official fix that mitigates this vulnerability by disregarding address records in the additional section unless explicitly relevant to authority NS records. Users should upgrade to Unbound 1.25.1 or later to remediate this issue. Since no other remediation level or patch information is provided, and the vulnerability affects on-premises software, upgrading is the recommended action. Patch status is confirmed by the vendor advisory embedded in the description.