CVE-2025-11411 in Unbound
Summary
by MITRE • 10/22/2025
NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/08/2026
The vulnerability described in CVE-2025-11411 represents a significant security flaw in NLnet Labs Unbound DNS resolver versions up to 1.24.1, exposing systems to potential domain hijacking attacks through manipulation of DNS response data. This issue specifically targets the resolver's handling of NS (Name Server) resource record sets that are transmitted in the authority section of DNS replies. The vulnerability stems from Unbound's behavior of accepting and updating delegation information when receiving NS RRSets that complement positive DNS replies, creating an opportunity for malicious actors to inject poisoned data that can alter the resolver's understanding of authoritative name server configurations.
The technical implementation of this vulnerability involves the exploitation of unsolicited NS RRSets that can be injected into DNS responses through various attack vectors including packet spoofing and fragmentation attacks. When Unbound processes these responses, it evaluates the trustworthiness of incoming data based on the principle that in-zone data for delegation points carries sufficient credibility to warrant updating existing resolver state. This mechanism, while intended to maintain accurate delegation information, becomes problematic when malicious actors can inject NS RRSets that appear to originate from legitimate zones, causing the resolver to update its internal records with incorrect delegation data. The flaw operates at the DNS resolver level, specifically targeting the validation and processing of authority section data during DNS query resolution.
The operational impact of this vulnerability extends beyond simple DNS cache poisoning to potentially enable complete domain hijacking scenarios where attackers can redirect traffic from legitimate to malicious name servers. This threat model aligns with the attack patterns documented in the MITRE ATT&CK framework under DNS tunneling and cache poisoning techniques, where adversaries manipulate DNS resolution behavior to redirect network traffic. The vulnerability affects the fundamental trust model of DNS resolvers, potentially allowing attackers to compromise the integrity of DNS resolution across affected networks, particularly in environments where Unbound is used as a recursive resolver or forwarder.
The mitigation implemented in Unbound 1.24.1 addresses the core issue by introducing scrubbing mechanisms that remove unsolicited NS RRSets and their associated address records from DNS responses before they can influence resolver state updates. This fix specifically targets the problematic behavior by ensuring that only solicited and properly authenticated NS data can modify delegation information within the resolver. The subsequent release of Unbound 1.24.2 further strengthens this protection by extending the scrubbing mechanism to cover YXDOMAIN and non-referral nodata responses, which are additional attack vectors where malicious actors could exploit similar injection techniques. These fixes align with CWE-284 (Improper Access Control) and CWE-347 (Improper Verification of Cryptographic Signature) categories, as they address weaknesses in access control verification and data validation mechanisms within the DNS resolution process, ensuring that only trusted data sources can influence resolver behavior and maintain the integrity of the DNS resolution chain.
Organizations deploying Unbound DNS resolvers must prioritize upgrading to version 1.24.2 or later to mitigate this vulnerability, as the attack surface remains significant for any network infrastructure relying on DNS resolution for critical operations. The fix represents a defensive measure that aligns with industry best practices for DNS security, particularly in environments where DNS resolvers serve as critical infrastructure components. Network administrators should also implement additional monitoring and logging of DNS resolution behavior to detect potential exploitation attempts, while maintaining awareness of the broader DNS security landscape and potential for similar vulnerabilities in other DNS resolver implementations.