Unbound EUVD-2026-31083

The primary fix is to upgrade to Unbound 1.25.1, which patches this vulnerability by disregarding address records from the additional section when they are not explicitly relevant to authority NS records, eliminating the promiscuous caching behavior. The vendor advisory is at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt. Where immediate upgrade is not possible, operators should restrict network access to the Unbound resolver to trusted clients only, reducing exposure to adjacent-network spoofing; note this does not prevent fragmentation attacks from authorized clients. Enabling and enforcing DNSSEC validation limits poisoning effectiveness for signed zones because forged records fail signature verification, but this does not fully mitigate the vulnerability and provides no protection for unsigned zones. Blocking IP fragmentation at the network perimeter reduces the fragmentation attack vector but may cause legitimate large DNS responses to fail, potentially disrupting DNS resolution for DNSSEC-heavy or large-record responses. Since this is a complement to CVE-2025-11411, systems that previously patched for that CVE but remain on versions below 1.25.1 are still exposed and must upgrade.