CVE-2026-42960
CWE-349Published: May 20, 2026· Updated: May 20, 2026
Official Description
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.
Risk Analysis
This critical vulnerability in NLnet Labs Unbound allows for DNS cache poisoning through promiscuous records in the authority section. With a CVSS score of 10.0, this flaw enables an unauthenticated, remote attacker to inject malicious records into Unbound's cache, potentially redirecting users to malicious sites. This vulnerability is remotely exploitable.
No public exploit is currently known for this vulnerability. The remote exploitability and lack of authentication make this a severe threat to DNS integrity.
Upgrade NLnet Labs Unbound to a version beyond 1.25.0 to address this cache poisoning vulnerability. Ensure DNS resolvers are configured with appropriate security measures to prevent spoofing and fragmentation attacks.
Technical Analysis
CVE-2026-42960 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (1)
Quick Facts
Related CVEs (CWE-349)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-42960 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts