CVE-2026-42960 is a DNS cache poisoning flaw (CVSS 10.0) in NLnet Labs Unbound up to and including 1.25.0. Extra records in the authority section of a reply can be cached when they should not be. Unbound 1.25.1 fixes it, and a patch is available for 1.25.0 sources.
What's affected
NLnet Labs says Unbound up to and including version 1.25.0 is affected. Version 1.25.1 contains the fix. For people building from source, NLnet Labs also publishes a patch file for 1.25.0.
The advisory describes this as a complement to the fix for CVE-2025-11411, the earlier work on the same class of problem. Distribution packages may carry the fix under a different package version, so check your vendor.
How to check if you're exposed
unbound -V
On Debian, Ubuntu or Red Hat family systems, ask the package manager for the installed build and read the vendor's security tracker to see whether it includes the fix. For container images, check the tag.
Also note whether your Unbound is a recursive resolver for many clients, since a poisoned cache affects everyone who uses it.
What to do now
- Upgrade to Unbound 1.25.1, or install your distribution package that includes the fix.
- If you build from source on 1.25.0, apply the NLnet Labs patch as the advisory describes, then rebuild.
- Restart the service and flush the cache after the update.
- Keep DNSSEC validation turned on where you can, since signed zones add protection against forged data.
- Restrict which clients may query your resolver.
Why it matters
The weakness is CWE-349, acceptance of extraneous untrusted data with trusted data. A resolver builds trust in what it caches by where the data appears in a reply. The advisory says records other than NS, such as MX, could ride along in the authority section with address records in the additional section. If the authority data was trusted enough, Unbound cached the address records too.
The attacker still needs a way to put such data in a reply, for example by spoofing a packet or using fragmentation. The score is 10.0 because the effect reaches beyond the resolver itself. The KEV flag is false and the advisory does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does DNSSEC remove the risk?
The advisory does not say. DNSSEC is a good control for signed zones, but upgrade rather than rely on it.
Sources
Last reviewed: 19 October 2026.
