CVE-2025-11411 is a domain hijacking vulnerability in the Unbound DNS resolver component included in Red Hat Hardened Images. The issue arises from Unbound accepting promiscuous NS RRSets in the authority section of DNS replies, which can be exploited by injecting malicious NS RRSets and associated address records. This causes Unbound to update its cached delegation information with potentially poisoned data. The vulnerability is related to CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data). Red Hat has evaluated this issue and currently does not have a mitigation or fix that meets their criteria for ease of use, applicability, or stability.

An attacker can manipulate the DNS resolver's delegation information by injecting malicious NS RRSets, potentially redirecting DNS queries to attacker-controlled name servers. This compromises the integrity of DNS resolution for affected zones. The vulnerability does not impact confidentiality or availability but has a high integrity impact. There are no known exploits in the wild at this time.

Red Hat currently does not provide a mitigation or fix that meets their criteria for this vulnerability. Users should monitor Red Hat advisories for updates. No immediate action is required or recommended by Red Hat at this time.