Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison 
arbitrary sibling zones under NSEC-signed parent domains. Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move cache write stricly after validation and adding bailiwick check when updating wildcards.