CVE-2026-46582
Received Received - Intake

DNSSEC Validation Bypass in Unbound DNS Resolver

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-46582
EUVD
EUVD-2026-47670

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound 1.6.0
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-358 The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Unbound DNS software (versions 1.6.0 to 1.25.1) involves a replay attack where a wildcard DNSSEC-signed record is temporarily cached as secure based on RRSIG validation but later treated as bogus after NSEC validation. An attacker can exploit this by creating a CNAME record pointing to a sibling record near a wildcard, causing Unbound to cache an incorrect secure wildcard rrset. This poisoned cache entry can then alter DNS responses, redirecting queries to unintended targets.

Detection Guidance

Detection primarily involves checking Unbound DNS software versions and monitoring for unusual DNSSEC validation behaviors. Use 'unbound -V' to check the installed version. If running 1.6.0 to 1.25.1, the system is vulnerable. No specific commands detect active exploitation, but monitoring DNS logs for unexpected wildcard record resolutions or cache inconsistencies may indicate issues.

Impact Analysis

An attacker could manipulate DNS responses to redirect users to malicious sites or intercept traffic. This could lead to phishing attacks, data theft, or unauthorized access to systems relying on DNS resolution. The impact is limited to DNSSEC-validated domains and requires specific conditions to exploit.

Compliance Impact

This vulnerability could undermine data integrity and confidentiality by enabling DNS spoofing, potentially violating GDPR's data protection requirements or HIPAA's secure data transmission rules. Organizations using vulnerable Unbound versions may face compliance risks if DNSSEC validation is compromised.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later immediately. If upgrading is not possible, apply the manual patch provided by NLnet Labs. Disable the 'serve-expired' feature in Unbound's configuration as a temporary workaround until patching is complete. Monitor DNS logs for suspicious activities post-upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart