CVE-2026-42960
Description
A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS (such as MX records). A malicious actor who can inject crafted DNS responses—via packet spoofing or fragmentation attacks—can exploit this to poison Unbound's cache with attacker-controlled address records, potentially redirecting DNS resolution for affected domains.
Statement
The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. Exploitation requires the attacker to successfully inject or spoof DNS response packets, which increases attack complexity. However, successful exploitation can result in DNS cache poisoning, allowing the attacker to redirect DNS resolution for affected domains.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 10 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Changed | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Understanding the Weakness (CWE)
Access Control,Integrity
Technical Impact: Bypass Protection Mechanism; Modify Application Data
An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.
Acknowledgements
Red Hat would like to thank JianJun Chen (Tsinghua University), TaoFei Guo (Peking University), and Yang Luo (Tsinghua University) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
