Skip to content
Fencer Intel
critical 10.0

CVE-2026-42960 json

Possible cache poisoning via promiscuous records for the authority section

published 5mo ago modified 3mo ago also EUVD-2026-31083

cvss
10.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.

Patch / fix

  • NLnet Labs Unbound 1.25.1
  • unbound Debian 13 1.22.0-2+deb13u3
  • unbound Debian 14 1.25.1-1

debian advisories DEBIAN-CVE-2026-42960

  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.15
  • unbound Ubuntu 24.04 LTS 1.19.2-1ubuntu3.8
  • unbound Ubuntu 25.10 1.22.0-2ubuntu2.3
  • unbound Ubuntu 26.04 LTS 1.24.2-1ubuntu2.1
  • unbound Ubuntu Pro 14.04 LTS 1.4.22-1ubuntu4.14.04.3+esm3
  • unbound Ubuntu Pro 16.04 LTS 1.5.8-1ubuntu1.1+esm3
  • unbound Ubuntu Pro 18.04 LTS 1.6.7-1ubuntu2.6+esm4
  • unbound Ubuntu Pro 20.04 LTS 1.9.4-2ubuntu1.11+esm1

ubuntu advisories UBUNTU-CVE-2026-42960

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound hummingbird 1 1.25.1-1.hum1
  • unbound-libs hummingbird 1 1.25.1-1.hum1
  • unbound-munin hummingbird 1 1.25.1-1.hum1
  • unbound-utils hummingbird 1 1.25.1-1.hum1
  • unbound-anchor hummingbird 1 1.25.1-1.hum1
  • unbound-dracut hummingbird 1 1.25.1-1.hum1
  • python3-unbound hummingbird 1 1.25.1-1.hum1

red hat advisories RHSA-2026:20357

  • unbound SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.24.1-160000.2.1
  • unbound SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 1.20.0-150100.10.25.1

suse advisories SUSE-SU-2026:22160-1SUSE-SU-2026:22213-1SUSE-SU-2026:2369-1

  • unbound openSUSE Leap 16.0 1.24.1-160000.2.1
  • unbound openSUSE Tumbleweed 1.25.1-1.1

opensuse advisories openSUSE-SU-2026:21083-1openSUSE-SU-2026:10903-1

  • unbound Alpine 3.23, Alpine 3.22 1.25.2-r0
  • unbound Alpine 3.24 1.25.1-r0

alpine advisories ALPINE-CVE-2026-42960

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound Azure Linux 3.0 1.25.1-1

azure linux advisories AZL-87018

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-42960 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42960 updated cvss 5.9

unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 8 unbound, unbound-libs, python3-unbound Red Hat Enterprise Linux 9 unbound, unbound-libs, unbound-dracut, python3-unbound
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 10 unbound
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images unbound 1.25.1-1.hum1, unbound-libs 1.25.1-1.hum1, unbound-munin 1.25.1-1.hum1, unbound-utils 1.25.1-1.hum1, unbound-anchor 1.25.1-1.hum1, unbound-dracut 1.25.1-1.hum1, +1 more
    fixed: vendor fix RHSA-2026:20357

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 5.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber
CNA 4.0 5.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Affected products

  • NLnet Labs Unbound

Classification

Weakness
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.