CVE-2026-46582: NLnet Labs Unbound DNSSEC Vulnerability

CVE-2026-46582 Overview

CVE-2026-46582 affects NLnet Labs Unbound recursive DNS resolver versions 1.6.0 through 1.25.1. The vulnerability allows a malicious actor to poison the resolver cache through a replay of a wildcard RRSet on the serve-expired code path. A signed wildcard RRSet, when injected without its accompanying NSEC record, is briefly considered DNSSEC secure based on RRSIG validation alone before later NSEC validation marks it bogus. During this window, another thread on the serve-expired path can pick up the secure status and serve a poisoned answer to clients. The flaw is categorized under [CWE-358] Improperly Implemented Security Check for Standard.

Critical Impact
An attacker can replace a specific record adjacent to a wildcard with the wildcard content in the Unbound cache, altering DNS resolution for targeted hostnames through a race between DNSSEC validation stages.

Affected Products

NLnet Labs Unbound 1.6.0 through 1.25.1
Deployments with the serve-expired feature enabled
Recursive resolvers performing DNSSEC validation for wildcard-covered zones

Discovery Timeline

2026-07-22 - CVE-2026-46582 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-46582

Vulnerability Analysis

The vulnerability stems from a race condition between DNSSEC validation stages on the serve-expired code path. Unbound marks a wildcard RRSet as secure after RRSIG signature verification succeeds, then stores it in cache before completing NSEC validation that proves the wildcard actually covers the queried name. A second thread traversing the serve-expired path can retrieve the RRSet with its interim secure status and return it in a reply. Only afterward does full validation determine the answer is bogus, but the cached record has already been consumed.

Root Cause

The root cause is an improper ordering of security checks. The RRSIG-only secure marker is written to the shared cache before NSEC-based wildcard coverage validation completes. This creates a time-of-check to time-of-use inconsistency where the cache exposes an unvalidated secure status to concurrent lookups.

Attack Vector

An attacker controlling any DNSSEC-signed domain publishes a CNAME wrapper pointing at a record adjacent to a wildcard in a target zone that could be covered by that wildcard. The attacker first queries Unbound for the wildcard sibling record to seed a secure cache entry. After the entry expires, a query for the CNAME wrapper triggers resolution of the sibling. The attacker injects a signed wildcard RRSet response without the NSEC records. Unbound updates the expired sibling RRSet with the wildcard content and secure status before NSEC validation rejects the answer as bogus, leaving the poisoned RRSet in cache.

No verified proof-of-concept code has been published. See the NLnet Labs CVE-2026-46582 advisory for the vendor's technical description.

Detection Methods for CVE-2026-46582

Indicators of Compromise

Cached RRSets in Unbound where a specific name is answered with data identical to a sibling wildcard record, despite prior distinct content.
DNS responses to clients that carry an AD bit for names later flagged bogus by upstream re-validation.
Unbound val-log-level: 2 messages showing bogus NSEC validation shortly after a secure cache insert for the same RRSet.

Detection Strategies

Enable Unbound validator debug logging and correlate secure cache inserts with subsequent bogus determinations for the same owner name and type.
Compare authoritative zone content against resolver cache snapshots for names adjacent to wildcards to identify unexpected wildcard collapse.
Monitor for CNAME chains that terminate at wildcard-covered names originating from external DNSSEC-signed zones unrelated to the querying user population.

Monitoring Recommendations

Alert on repeated queries for the same CNAME target that resolves to a name adjacent to a wildcard, especially after TTL expiration.
Track anomalous rates of SERVFAIL responses following NOERROR responses for identical QNAMEs, indicating late bogus detection.
Ingest Unbound query and validator logs into a central analytics platform to establish baselines for DNSSEC validation outcomes.

How to Mitigate CVE-2026-46582

Immediate Actions Required

Upgrade Unbound to a version later than 1.25.1 that contains the fix once released by NLnet Labs.
Review the NLnet Labs advisory for the exact patched version and apply vendor guidance.
Inventory all recursive resolvers in the environment and confirm the running Unbound version and serve-expired configuration.

Patch Information

NLnet Labs published details for CVE-2026-46582 at the vendor advisory URL. Affected operators should apply the fixed release identified in that advisory. No third-party patches or backports are documented in the enriched data.

Workarounds

Disable the serve-expired feature by setting serve-expired: no in unbound.conf, since the vulnerability is explicit to the serve-expired path.
Restrict recursion to trusted clients using access-control directives to limit exposure to attacker-controlled queries.
Reduce or eliminate serve-expired-ttl and serve-expired-client-timeout values until the resolver is patched.

bash

# Configuration example: disable serve-expired in unbound.conf
server:
    serve-expired: no
    serve-expired-ttl: 0
    serve-expired-client-timeout: 0
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    val-log-level: 2