Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-42960

critical

CVE-2026-42960

unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance

Published Modified CWE 349
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Red Hat5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Amazon (high), Red Hat (medium), Azure Linux (medium), Ubuntu (medium).

Description

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 4.0unbound, unbound-devel, unbound-docs1.25.1-1.ph4
Photon OS 5.0unbound, unbound-devel, unbound-docs1.25.1-1.ph5
alpine 3.22unbound1.25.2-r0
alpine 3.23unbound1.25.2-r0
alpine 3.24unbound1.25.1-r0
alpine edgeunbound1.25.1-r0
amazon linux 2python2-unbound, python3-unbound, unbound and 3 more1.7.3-15.amzn2.0.14
amazon linux 2023python3-unbound, python3-unbound-debuginfo, unbound and 9 more1.17.1-1.amzn2023.0.12
Azure Linux 3.0unbound0:1.25.1-1.azl3
debian 11unboundno fix listed
debian 12unboundno fix listed
debian 13unbound1.22.0-2+deb13u3
Show all 143 entries from 44 sources
SourcePackageFixed in
Photon OS 4.0unbound1.25.1-1.ph4
Photon OS 4.0unbound-devel1.25.1-1.ph4
Photon OS 4.0unbound-docs1.25.1-1.ph4
Photon OS 5.0unbound1.25.1-1.ph5
Photon OS 5.0unbound-devel1.25.1-1.ph5
Photon OS 5.0unbound-docs1.25.1-1.ph5
alpine 3.22unbound1.25.2-r0
alpine 3.23unbound1.25.2-r0
alpine 3.24unbound1.25.1-r0
alpine edgeunbound1.25.1-r0
amazon linux 2python2-unbound1.7.3-15.amzn2.0.14
amazon linux 2python3-unbound1.7.3-15.amzn2.0.14
amazon linux 2unbound1.7.3-15.amzn2.0.14
amazon linux 2unbound-debuginfo1.7.3-15.amzn2.0.14
amazon linux 2unbound-devel1.7.3-15.amzn2.0.14
amazon linux 2unbound-libs1.7.3-15.amzn2.0.14
amazon linux 2023python3-unbound1.17.1-1.amzn2023.0.12
amazon linux 2023python3-unbound-debuginfo1.17.1-1.amzn2023.0.12
amazon linux 2023unbound1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-anchor1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-anchor-debuginfo1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-debuginfo1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-debugsource1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-devel1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-libs1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-libs-debuginfo1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-utils1.17.1-1.amzn2023.0.12
amazon linux 2023unbound-utils-debuginfo1.17.1-1.amzn2023.0.12
Azure Linux 3.0unbound0:1.25.1-1.azl3
debian 11unboundno fix listed
debian 12unboundno fix listed
debian 13unbound1.22.0-2+deb13u3
debian 14unbound1.25.1-1
echounbound1.22.0-2+deb13u3
rapidfort alma 10python3-unboundno fix listed
rapidfort alma 10unboundno fix listed
rapidfort alma 10unbound-anchorno fix listed
rapidfort alma 10unbound-develno fix listed
rapidfort alma 10unbound-dracutno fix listed
rapidfort alma 10unbound-libsno fix listed
rapidfort alma 10unbound-utilsno fix listed
rapidfort alma 8python3-unboundno fix listed
rapidfort alma 8unboundno fix listed
rapidfort alma 8unbound-develno fix listed
rapidfort alma 8unbound-libsno fix listed
rapidfort alma 9python3-unboundno fix listed
rapidfort alma 9unboundno fix listed
rapidfort alma 9unbound-develno fix listed
rapidfort alma 9unbound-dracutno fix listed
rapidfort alma 9unbound-libsno fix listed
rapidfort alpine 3.20unbound1.25.1-r0
rapidfort alpine 3.21unbound1.25.1-r0
rapidfort alpine 3.22unbound1.25.1-r0
rapidfort alpine 3.23unbound1.25.1-r0
rapidfort amazon linux 2023python3-unbound1.17.1-1.amzn2023.0.12
rapidfort amazon linux 2023unbound0:1.17.1-1.amzn2023.0.12
rapidfort amazon linux 2023unbound-anchor0:1.17.1-1.amzn2023.0.12
rapidfort amazon linux 2023unbound-devel1.17.1-1.amzn2023.0.12
rapidfort amazon linux 2023unbound-libs0:1.17.1-1.amzn2023.0.12
rapidfort amazon linux 2023unbound-utils1.17.1-1.amzn2023.0.12
rapidfort debian 12rf-unbound0:1.26.0-1
rapidfort debian 12unbound0:1.22.0-2+deb13u3, 0:1.25.1-1
rapidfort debian 13rf-unbound0:1.26.0-1
rapidfort debian 13unbound0:1.22.0-2+deb13u3, 0:1.25.1-1
rapidfort fedora 41rf-unbound0:1.24.1-2.fc41
rapidfort fedora 41rf-unbound-anchor0:1.24.1-2.fc41
rapidfort fedora 41rf-unbound-libs0:1.24.1-2.fc41
rapidfort fedora 41unbound0:1.24.1-2.fc41
rapidfort fedora 41unbound-anchor0:1.24.1-2.fc41
rapidfort fedora 41unbound-libs0:1.24.1-2.fc41
rapidfort fedora 43python3-unbound1.25.1-1.fc43
rapidfort fedora 43rf-unbound0:1.25.1-1.fc43
rapidfort fedora 43rf-unbound-anchor0:1.25.1-1.fc43
rapidfort fedora 43rf-unbound-libs0:1.25.1-1.fc43
rapidfort fedora 43unbound0:1.25.1-1.fc43
rapidfort fedora 43unbound-anchor0:1.25.1-1.fc43
rapidfort fedora 43unbound-devel1.25.1-1.fc43
rapidfort fedora 43unbound-dracut1.25.1-1.fc43
rapidfort fedora 43unbound-libs0:1.25.1-1.fc43
rapidfort fedora 43unbound-munin1.25.1-1.fc43
rapidfort fedora 43unbound-utils1.25.1-1.fc43
rapidfort Oracle Linux 10python3-unboundno fix listed
rapidfort Oracle Linux 10unboundno fix listed
rapidfort Oracle Linux 10unbound-anchorno fix listed
rapidfort Oracle Linux 10unbound-develno fix listed
rapidfort Oracle Linux 10unbound-dracutno fix listed
rapidfort Oracle Linux 10unbound-libsno fix listed
rapidfort Oracle Linux 10unbound-utilsno fix listed
rapidfort Oracle Linux 9python3-unboundno fix listed
rapidfort Oracle Linux 9unboundno fix listed
rapidfort Oracle Linux 9unbound-develno fix listed
rapidfort Oracle Linux 9unbound-dracutno fix listed
rapidfort Oracle Linux 9unbound-libsno fix listed
rapidfort Red Hat 10python3-unboundno fix listed
rapidfort Red Hat 10unboundno fix listed
rapidfort Red Hat 10unbound-anchorno fix listed
rapidfort Red Hat 10unbound-develno fix listed
rapidfort Red Hat 10unbound-dracutno fix listed
rapidfort Red Hat 10unbound-libsno fix listed
rapidfort Red Hat 10unbound-utilsno fix listed
rapidfort Red Hat 9python3-unboundno fix listed
rapidfort Red Hat 9unboundno fix listed
rapidfort Red Hat 9unbound-develno fix listed
rapidfort Red Hat 9unbound-dracutno fix listed
rapidfort Red Hat 9unbound-libsno fix listed
rapidfort rocky 10python3-unboundno fix listed
rapidfort rocky 10unboundno fix listed
rapidfort rocky 10unbound-anchorno fix listed
rapidfort rocky 10unbound-develno fix listed
rapidfort rocky 10unbound-dracutno fix listed
rapidfort rocky 10unbound-libsno fix listed
rapidfort rocky 10unbound-utilsno fix listed
rapidfort rocky 8python3-unboundno fix listed
rapidfort rocky 8unboundno fix listed
rapidfort rocky 8unbound-develno fix listed
rapidfort rocky 8unbound-libsno fix listed
rapidfort rocky 9python3-unboundno fix listed
rapidfort rocky 9unboundno fix listed
rapidfort rocky 9unbound-develno fix listed
rapidfort rocky 9unbound-dracutno fix listed
rapidfort rocky 9unbound-libsno fix listed
rapidfort ubuntu 20.04rf-unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
rapidfort ubuntu 20.04unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
rapidfort ubuntu 22.04rf-unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
rapidfort ubuntu 22.04unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
rapidfort ubuntu 24.04rf-unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
rapidfort ubuntu 24.04unbound0:1.13.1-1ubuntu5.15, 0:1.19.2-1ubuntu3.8, 0:1.24.2-1ubuntu2.1
Red Hatopenshift/ose-rhel-coreos-8no fix listed
Red Hatopenshift/ose-rhel-coreos-9no fix listed
Red Hatpython3-unboundno fix listed
Red Hatunboundno fix listed
Red Hatunbound-develno fix listed
Red Hatunbound-dracutno fix listed
Red Hatunbound-libsno fix listed
Red Hatunbound-pythonno fix listed
seal Red Hat 8seal-unbound1.16.2-5.8.el8_10+sp999
seal Red Hat 8unbound1.16.2-5.8.el8_10+sp999
ubuntu 18.04-ESMunbound1.6.7-1ubuntu2.6+esm4
ubuntu 20.04-ESMunbound1.9.4-2ubuntu1.11+esm1
ubuntu 22.04unbound1.13.1-1ubuntu5.15
ubuntu 24.04unbound1.19.2-1ubuntu3.8
ubuntu 25.10unbound1.22.0-2ubuntu2.3
ubuntu 26.04unbound1.24.2-1ubuntu2.1

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.