Insufficient verification of data authenticity in Unbound - CVE-2026-46582
Published: July 23, 2026
Vulnerability identifier: #VU139233
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-46582
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: NLnet Labs
Affected software:
Unbound
Unbound
Detailed vulnerability description
The vulnerability allows a remote attacker to poison the DNS cache and cause incorrect DNS resolution.
The vulnerability exists due to improper cache state management in the rrset cache and DNSSEC validation logic when processing injected wildcard rrsets on the serve expired path. A remote attacker can inject a signed wildcard rrset without the accompanying NSEC rrset to poison the DNS cache and cause incorrect DNS resolution.
Exploitation requires a DNSSEC-signed domain controlled by the attacker and a CNAME wrapper record pointing to a record adjacent to a wildcard that could cover it.
How to mitigate CVE-2026-46582
Install security update from vendor's website.