CVE-2026-46582 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists in NLnet Labs Unbound DNS resolver versions 1.6.0 through 1.25.1 and represents a sophisticated cache poisoning attack leveraging DNSSEC validation timing discrepancies. The flaw occurs when a wildcard resource record set is replayed as another piece of data, temporarily appearing DNSSEC secure based solely on RRSIG validation before NSEC validation identifies it as bogus. This creates a temporal window where malicious actors can exploit the race condition between different threads processing DNS responses. The vulnerability specifically targets the serve expired path mechanism where resolving threads initially mark rrsets as secure while other threads process expired records, allowing for inconsistent state management.
The technical implementation involves a carefully crafted attack scenario where a malicious actor creates a poisonous effect by manipulating DNSSEC-signed domains with CNAME wrapper records pointing to sibling records near wildcards. When querying for wildcard sibling records, the system caches the wildcard rrset with secure status before proper NSEC validation completes. This temporal inconsistency allows attackers to inject malicious data that appears legitimate during initial validation but fails proper security checks upon subsequent processing. The vulnerability operates through thread synchronization issues where one thread establishes secure status while another processes expired paths, creating a race condition in cache state management.
The operational impact of this vulnerability is significant as it enables attackers to manipulate DNS responses without requiring direct access to the authoritative servers or the ability to forge RRSIG signatures. The attack relies on the specific timing of cache updates and validation processes, where wildcard rrsets can be injected without proper NSEC records, creating a false sense of security during initial processing. This allows malicious actors to redirect traffic by poisoning the cache with wildcard data that appears legitimate but contains incorrect information when properly validated against NSEC records. The vulnerability specifically affects Unbound's serve expired path functionality and requires injection of signed wildcard rrsets without their accompanying NSEC validation records.
Mitigation strategies should focus on implementing proper thread synchronization mechanisms to prevent race conditions during cache state updates, ensuring that all validation processes complete before marking records as secure. The system should enforce stricter validation timing requirements where NSEC records are validated before allowing wildcard rrset caching operations. Additionally, implementing more robust cache invalidation procedures and enhancing the integrity checking of cached data can help prevent this type of temporal inconsistency. Organizations should consider upgrading to patched versions of Unbound, implementing additional monitoring for anomalous DNS behavior, and ensuring proper network segmentation to limit the attack surface. This vulnerability aligns with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) with potential lateral movement implications through DNS cache poisoning attacks.