CVE-2026-46582
Description
A flaw was found in Unbound, a Domain Name System (DNS) resolver. A remote attacker can exploit a vulnerability in how Unbound handles expired DNSSEC (DNS Security Extensions) records. By injecting a replayed wildcard record set, an attacker can cause Unbound to temporarily consider it secure, leading to the caching of a poisoned record. This can result in information disclosure, where a legitimate DNS record is incorrectly resolved as a wildcard record, potentially misdirecting network traffic.
Statement
This issue has a Low impact as it requires a sophisticated attacker to inject specific DNSSEC wildcard replay data. The vulnerability in Unbound's handling of expired DNSSEC records could lead to temporary information disclosure, where a legitimate DNS record is briefly misresolved as a wildcard. This limited impact and the high attack complexity contribute to its Low severity.
Mitigation
To mitigate this issue, disable the serve-expired feature by setting serve-expired: no in the Unbound configuration if it is not strictly required. This entirely removes the vulnerable code path where the cache poisoning occurs.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
