PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46582 NLnet Labs CVE debrief

A vulnerability in Unbound 1.6.0 up to and including 1.25.1 allows for DNSSEC secure cache poisoning through replay of a wildcard rrset. This issue arises when a replay of a wildcard rrset as another piece of data could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. The vulnerability occurs when the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply. This can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain and a CNAME wrapper record that points to a record next to a wildcard. The updated poisoned rrset is now secure and points to the wildcard.

Vendor
NLnet Labs
Product
Unbound
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Administrators and users of Unbound 1.6.0 up to and including 1.25.1 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing and updating DNSSEC configurations, implementing additional monitoring and validation for DNSSEC secure cache, and ensuring that Unbound is updated to a version that fixes this vulnerability. Affected operators, platforms, and security teams should prioritize vulnerability management and review compensating controls for exposed systems.

Technical summary

The vulnerability occurs when the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply. This can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain and a CNAME wrapper record that points to a record next to a wildcard. The issue is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.

Defensive priority

High

Recommended defensive actions

  • Update Unbound to a version that fixes this vulnerability
  • Implement additional monitoring and validation for DNSSEC secure cache
  • Review and update DNSSEC configuration to prevent similar attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-22T14:17:19.397Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This vulnerability affects Unbound 1.6.0 up to and including 1.25.1. Limited source detail is available, and defenders should verify the affected scope and severity. The CVE record and NVD entry provide the primary source grounding for this debrief.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T14:17:19.397Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.