Bug 2479821 (CVE-2026-42960)

Summary: CVE-2026-42960 unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS (such as MX records). A malicious actor who can inject crafted DNS responses—via packet spoofing or fragmentation attacks—can exploit this to poison Unbound's cache with attacker-controlled address records, potentially redirecting DNS resolution for affected domains.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2480119, 2481462    
Bug Blocks:    
Deadline: 2026-05-20   

Description OSIDB Bzimport 2026-05-19 12:13:51 UTC 
Acceptance of Extraneous Untrusted Data vulnerability in the DNS response scrubbing logic of the Unbound DNS resolver. The flaw allows promiscuous RRSets that complement DNS replies in the authority section to be cached when accompanied by address records in the additional section. Specifically, Unbound marks additional section address records as allowed for any authority RRSet type, not just NS records. A malicious actor can exploit this by injecting RRSets other than NS (e.g., MX) accompanied by address records via spoofed reply packets or fragmentation attacks. Unbound then accepts and caches the relative address records from the additional section if the authority RRSet has sufficient trust, enabling DNS cache poisoning.