CVE-2026-46582: CWE-358: Improperly Implemented Security Check for Standard in NLnet Labs Unbound
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.
AI Analysis
Technical Summary
CVE-2026-46582 describes a vulnerability in NLnet Labs Unbound DNS resolver from version 1.6.0 through 1.25.1 where a replayed wildcard rrset can be briefly cached as DNSSEC secure based solely on RRSIG validation before NSEC validation marks it as bogus. When the resolver's serve expired path updates an expired sibling record with this cached secure wildcard rrset, it can cause the sibling record to be poisoned by the wildcard. An attacker can exploit this by injecting a signed wildcard rrset without the NSEC record, combined with a CNAME wrapper pointing to a sibling record of the wildcard. This leads to the poisoned rrset being accepted as secure, potentially altering DNS responses incorrectly. The vulnerability specifically affects the serve expired path and requires precise conditions for exploitation.
Potential Impact
The vulnerability allows an attacker to poison DNS responses by causing a specific DNS record next to a wildcard to be replaced with the wildcard record marked as secure. This can lead to incorrect DNS resolution results, potentially redirecting queries or causing denial of service for certain DNS names. The CVSS score is 3.7 (low severity) with no confidentiality or availability impact, only integrity impact with high attack complexity and no privileges or user interaction required. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor NLnet Labs advisories for updates. Until a patch is available, cautious use of the serve expired feature or disabling it may reduce exposure, but this is not confirmed by the vendor. No other specific mitigations are provided.
CVE-2026-46582: CWE-358: Improperly Implemented Security Check for Standard in NLnet Labs Unbound
Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.
CVSS v3.1
Score 3.7low
Affected software
pkg:github/nlnetlabs/unboundRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46582 describes a vulnerability in NLnet Labs Unbound DNS resolver from version 1.6.0 through 1.25.1 where a replayed wildcard rrset can be briefly cached as DNSSEC secure based solely on RRSIG validation before NSEC validation marks it as bogus. When the resolver's serve expired path updates an expired sibling record with this cached secure wildcard rrset, it can cause the sibling record to be poisoned by the wildcard. An attacker can exploit this by injecting a signed wildcard rrset without the NSEC record, combined with a CNAME wrapper pointing to a sibling record of the wildcard. This leads to the poisoned rrset being accepted as secure, potentially altering DNS responses incorrectly. The vulnerability specifically affects the serve expired path and requires precise conditions for exploitation.
Potential Impact
The vulnerability allows an attacker to poison DNS responses by causing a specific DNS record next to a wildcard to be replaced with the wildcard record marked as secure. This can lead to incorrect DNS resolution results, potentially redirecting queries or causing denial of service for certain DNS names. The CVSS score is 3.7 (low severity) with no confidentiality or availability impact, only integrity impact with high attack complexity and no privileges or user interaction required. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor NLnet Labs advisories for updates. Until a patch is available, cautious use of the serve expired feature or disabling it may reduce exposure, but this is not confirmed by the vendor. No other specific mitigations are provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-06-22T10:11:10.536Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60c4219c2644c7f80e913d
Added to database: 07/22/2026, 13:22:41 UTC
Last enriched: 07/22/2026, 13:40:51 UTC
Last updated: 09/03/2026, 10:52:09 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.