Search: CVE-2025-11411

NLnet Labs Unbound versions up to and including 1.24.1 are vulnerable to domain hijack attacks via acceptance of unsolicited NS RRSets in DNS replies. Attackers can inject malicious NS RRSets to poison the resolver's delegation information. Version 1.24.1 introduced a fix that removes unsolicited NS RRSets from replies, and 1.24.2 further improves this by scrubbing such data from additional reply types.