The CVE number for this vulnerability is CVE-2026-46582.


== Summary
A replay of a wildcard rrset as another piece of data, could be briefly
considered DNSSEC secure based only on the RRSIG validation and stored into
cache, before later validation treats it as bogus based on NSEC validation.
When the resolving thread puts secure on the rrset, and another thread that
is on the serve expired path then picks up the updated rrset contents with the
secure status for a reply, it can be used to change a specific record, next to
a wildcard that could be covered by the wildcard, into the wildcard.

Unbound 1.25.2 includes fixes so that wildcards do not have their secure status
put in cache, until this is proven as the RRSIG verify is not enough by itself.
Then when the NSECs do not check out, it puts bogus on the rrset, so that a
later message store by the validator does not put secure on the rrset.
The rrset cache then always has correct name expansion and wildcard data, when
it is labelled secure.


== Affected products
Unbound 1.6.0 up to and including version 1.25.1.


== Description
A malicious actor can exploit the possible poisonous effect by having any
DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper
record that points to a record next to a wildcard (that could be covered by
the wildcard).
Then quering Unbound for the wildcard sibling record would seed the secure
message.
A later (after expiry) query for the CNAME wrapper would need to resolve the
target sibling record.
If the wildcard replay is injected into the response, the wildcard rrset will
update the expired sibling record with a secure status before completing proper
wildcard validation with NSEC records and eventually treating the CNAME wrapper
answer as bogus.
The updated poisoned rrset is now secure and points to the wildcard.

This vulnerability is explicit for the serve expired path and needs injection
of the signed wildcard rrset without the NSEC accompanying rrset.

Unbound 1.25.2 includes fixes so that wildcards do not have their secure status
put in cache, until this is proven as the RRSIG verify is not enough by itself.
Then when the NSECs do not check out, it puts bogus on the rrset, so that a
later message store by the validator does not put secure on the rrset.
The rrset cache then always has correct name expansion and wildcard data, when
it is labelled secure.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-46582.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-46582.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.