CVE-2026-46582 describes a vulnerability in NLnet Labs Unbound DNS resolver from version 1.6.0 through 1.25.1 where a replayed wildcard rrset can be briefly cached as DNSSEC secure based solely on RRSIG validation before NSEC validation marks it as bogus. When the resolver's serve expired path updates an expired sibling record with this cached secure wildcard rrset, it can cause the sibling record to be poisoned by the wildcard. An attacker can exploit this by injecting a signed wildcard rrset without the NSEC record, combined with a CNAME wrapper pointing to a sibling record of the wildcard. This leads to the poisoned rrset being accepted as secure, potentially altering DNS responses incorrectly. The vulnerability specifically affects the serve expired path and requires precise conditions for exploitation.

The vulnerability allows an attacker to poison DNS responses by causing a specific DNS record next to a wildcard to be replaced with the wildcard record marked as secure. This can lead to incorrect DNS resolution results, potentially redirecting queries or causing denial of service for certain DNS names. The CVSS score is 3.7 (low severity) with no confidentiality or availability impact, only integrity impact with high attack complexity and no privileges or user interaction required. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor NLnet Labs advisories for updates. Until a patch is available, cautious use of the serve expired feature or disabling it may reduce exposure, but this is not confirmed by the vendor. No other specific mitigations are provided.