CVE-2025-11411
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-12-05
Assigner: NLnet Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nlnet_labs | unbound | 1.24.2 |
| nlnet_labs | unbound | 1.13.1-1+deb11u6 |
| nlnet_labs | unbound | 1.24.0 |
| nlnet_labs | unbound | 1.24.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-349 | The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects NLnet Labs Unbound DNS resolver versions up to 1.24.0. It involves 'Promiscuous NS RRSets' in the authority section of DNS replies, which are used by the resolver to update delegation information for DNS zones, specifically the zone's name servers. An attacker can exploit this by injecting spoofed NS RRSets and possibly their address records through spoofed packets or fragmentation attacks. Unbound would mistakenly trust and update its cache with this malicious data, leading to cache poisoning at the delegation point, which can result in domain hijacking. The issue is fixed in Unbound 1.24.1 by scrubbing unsolicited NS RRSets and their address records from replies. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform cache poisoning on the DNS resolver, causing it to update its delegation information with malicious data. This can lead to domain hijacking, where users trying to access legitimate domains are redirected to malicious sites controlled by the attacker. Such redirection can result in phishing, data theft, malware distribution, or other security breaches impacting users and organizations relying on the affected DNS resolver. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade Unbound to version 1.24.1, which includes a fix that scrubs unsolicited NS RRSets and their associated address records from DNS replies. If upgrading is not possible right away, apply the provided patches for version 1.24.0: either the full patch with options, tests, and documentation updates or the minimal patch with essential code changes. Apply patches using the command `patch -p1 < patch_file.diff` followed by `make install`. These steps prevent cache poisoning by rejecting malicious NS RRSet injections. [1]