CVE-2025-11411: NLnet Labs Unbound DNS Poisoning Flaw

CVE-2025-11411 Overview

CVE-2025-11411 affects NLnet Labs Unbound, a widely deployed validating, recursive, and caching DNS resolver. Versions up to and including 1.24.1 accept unsolicited NS resource record sets (RRSets) placed in the authority section of positive DNS replies. An attacker who can inject or spoof responses on the network path can trick Unbound into updating its delegation information for a zone. This enables domain hijack conditions where subsequent queries for the target zone are directed to attacker-controlled name servers. The flaw is classified as improperly trusted data ([CWE-349]) and was fixed in Unbound 1.24.1 and further hardened in 1.24.2.

Critical Impact
Successful exploitation allows adversaries to poison delegation data for arbitrary zones, redirecting DNS traffic to malicious infrastructure and enabling downstream phishing, credential theft, and traffic interception.

Affected Products

NLnet Labs Unbound versions up to and including 1.24.1
Debian LTS distributions shipping vulnerable Unbound packages
Downstream Linux distributions and appliances embedding Unbound as a recursive resolver

Discovery Timeline

2025-10-22 - CVE-2025-11411 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11411

Vulnerability Analysis

Unbound processes NS RRSets that appear in the authority section of DNS replies as authoritative updates to its cached delegation information. The resolver applies a trust hierarchy in which in-zone data at the delegation point is treated as sufficient to overwrite existing NS records. This behavior was intended to keep the resolver's view of a zone's name servers current. An attacker who injects a positive reply containing crafted NS RRSets, and optionally the corresponding glue address records, can replace the delegation cached by the resolver. Injection can be achieved by spoofing UDP responses or by exploiting fragmentation attacks against on-path or off-path traffic. Once the poisoned delegation is cached, subsequent recursive lookups for the target zone are steered to attacker-selected name servers.

Root Cause

The root cause is insufficient scrubbing of unsolicited resource records in reply messages. Unbound accepted NS RRSets from replies that did not warrant a delegation update and assigned them enough trust to overwrite existing entries. This is an instance of [CWE-349]: Acceptance of Extraneous Untrusted Data With Trusted Data.

Attack Vector

Exploitation requires the attacker to inject a DNS response that reaches the resolver. The CVSS 4.0 vector indicates an adjacent network attack vector with low complexity and no privileges required, and exploitation depends on prerequisite conditions such as winning a response race or successfully spoofing packet fragments. No user interaction is needed. Impact focuses on integrity of DNS data served to clients rather than confidentiality or availability of the resolver itself. See the NLnet Labs advisory and the OpenWall discussion for protocol-level details.

Detection Methods for CVE-2025-11411

Indicators of Compromise

Unexpected changes to cached NS RRSets for high-value zones observed in Unbound cache dumps produced via unbound-control dump_cache.
DNS answers for internal or business-critical domains resolving to name servers not listed by the authoritative zone operator.
Anomalous volumes of DNS responses with authority sections containing NS records that do not correspond to outstanding queries.

Detection Strategies

Compare live delegation data returned by the resolver against authoritative WHOIS and registry data for critical zones on a scheduled basis.
Enable Unbound query logging and diff cached delegations before and after suspicious traffic spikes.
Monitor for fragmented DNS responses and out-of-window UDP replies at the network perimeter, which are prerequisites for the injection techniques described in the advisory.

Monitoring Recommendations

Forward Unbound logs and resolver telemetry to a centralized analytics platform for retention and correlation with network flow data.
Alert on newly observed authoritative name servers appearing for previously stable zones.
Track resolver package versions across the fleet to identify hosts still running Unbound 1.24.1 or earlier.

How to Mitigate CVE-2025-11411

Immediate Actions Required

Upgrade Unbound to version 1.24.2 or later, which scrubs unsolicited NS RRSets from positive replies and additionally from YXDOMAIN and non-referral NODATA replies.
Apply Debian LTS updates referenced in the debian-lts-announce archive and the follow-up announcement for affected package versions.
Flush the Unbound cache after upgrade using unbound-control flush_zone . to purge any previously poisoned delegation records.

Patch Information

NLnet Labs released Unbound 1.24.1 with an initial fix that scrubs unsolicited NS RRSets and their glue address records from replies. Unbound 1.24.2 extends the scrubbing logic to cover YXDOMAIN and non-referral NODATA responses, closing residual poisoning paths. Refer to the NLnet Labs CVE-2025-11411 patch notes for the authoritative patch description.

Workarounds

Enable DNSSEC validation on Unbound and require validation for critical zones, which prevents forged delegations from resolving successfully when the zone is signed.
Restrict resolver reachability using access-control statements in unbound.conf so that only trusted client networks can query the resolver, reducing the attack surface for adjacent-network injection.
Configure harden-referral-path: yes and use-caps-for-id: yes in unbound.conf to increase resistance to spoofed responses while patching is scheduled.

bash

# Configuration example
# /etc/unbound/unbound.conf hardening snippet
server:
    harden-referral-path: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse

# Verify installed version is 1.24.2 or later
unbound -V | head -n 1

# Flush cached delegation data after upgrade
unbound-control flush_zone .