In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC… (CVE-2026-46582)

In NLnet Labs Unbound versions 1.6.0 up to and including 1.25.1, a vulnerability exists in the DNSSEC validation process involving replay of a wildcard rrset. Initially, the replayed wildcard rrset is accepted as secure based on RRSIG validation and cached. Later, NSEC validation marks it as bogus. However, due to a race condition in the serve expired path, another thread may serve the cached rrset with a secure status, effectively poisoning the cache. An attacker can exploit this by using any DNSSEC-signed domain with a CNAME wrapper pointing to a record adjacent to a wildcard, causing the poisoned rrset to replace the specific record with the wildcard. This requires injection of the signed wildcard rrset without the NSEC accompanying rrset. The vulnerability affects the serve expired path and can cause incorrect DNS responses.

The vulnerability allows an attacker to poison the DNS cache in Unbound by causing a specific DNS record to be replaced with a wildcard record that appears DNSSEC secure temporarily. This can lead to incorrect DNS responses being served, potentially redirecting queries to unintended targets. The impact is limited to integrity (data modification) without confidentiality or availability effects. The CVSS score of 3.7 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the potential for cache poisoning via the serve expired path and consider disabling serve expired functionality if feasible or applying any vendor-recommended mitigations once published.