Disclosure summary
NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.
Source-reported weakness categories
CWE-349
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-11411
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Microsoft Security Updates (CVRF) · 2025-Oct
Open original source · Updated Dec 06, 2025
Possible domain hijacking via promiscuous records in the authority section
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | azl3 unbound 1.19.1-4 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 unbound 1.19.1-3 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 unbound 1.19.1-5 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 unbound 1.19.1-4 on CBL Mariner 2.0 | (MSRC status code 3) |
Vendor remediation references
- CBL-Mariner Releases · build 1.19.1-5 · product IDs 17617-17084, 20736-17084
- Vendor guidance · product IDs 17617-17084, 20736-17084
- CBL-Mariner Releases · build 1.19.1-4 · product IDs 19765-17086, 20698-17086
- Vendor guidance · product IDs 19765-17086, 20698-17086
Original records & references
PUBLISHED 2025-10-22T09:15:29-04:00
MODIFIED 2026-10-08T07:10:00-04:00
INGESTED 2026-10-08T12:35:06-04:00