CyberSecBulletin
CVE-2026-42960NVD status: Analyzed

Unbound: Acceptance of Extraneous Untrusted Data With Trusted Data

Published Updated By the CyberSecBulletin desk

CVE-2026-42960 is a critical-severity acceptance of extraneous untrusted data with trusted data vulnerability in Unbound from NLnet Labs, with a CVSS 3.1 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 1.25.1 as the first without the flaw, so updating Unbound to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Unbound to 1.25.1 or a later version.
  2. Read the advisory on nlnetlabs.nl for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
NLnet LabsUnboundbefore 1.25.11.25.1

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
NoneNo data is disclosed.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.05.7MediumCNA (nlnetlabs.nl)
CVSS 3.110.0CriticalNVD

Official description

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Acceptance of Extraneous Untrusted Data With Trusted Data

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

More Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilities (CWE-349)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Unbound

All Unbound vulnerabilities

Recent Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilities

Spotted an error? Tell us.