Unbound EUVD-2026-31083

The attacker must occupy or simulate an adjacent network position (AV:A) capable of injecting spoofed DNS reply packets or executing IP fragmentation attacks against the Unbound resolver instance. Successful poisoning additionally requires the forged authority RRSet to satisfy Unbound's in-zone trust threshold for the delegation point (AT:P - this is the specific attack prerequisite). Exploitation is limited by: the adjacent-network constraint (mass internet-wide exploitation requires off-path spoofing capability or network adjacency, not arbitrary remote access); the requirement that the forged authority RRSet meet Unbound's in-zone delegation trust evaluation; and the inherent DNS race condition that the attacker's reply must arrive before the legitimate response. DNSSEC-signed zones are not poisonable via this method if DNSSEC validation is enforced end-to-end, as forged records would fail signature verification. Unauthenticated exploitation is confirmed by PR:N in the CVSS vector; no prior authentication to Unbound is required.

The CVSS 4.0 score of 5.7 (Medium) reflects a meaningfully constrained threat model. AV:A (Adjacent network) requires the attacker to be positioned to inject spoofed or fragmented DNS packets-this is not a trivially internet-wide attack but is achievable via off-path spoofing against under-protected networks or via controlled infrastructure on the same segment. AT:P (Attack Requirements: Present) confirms specific conditions must be met, namely the forged authority RRSet must satisfy Unbound's in-zone delegation trust evaluation, limiting opportunistic mass exploitation. Despite the moderate overall score, integrity and availability impacts are high on subsequent systems (SI:H, SA:H), reflecting that poisoned resolver cache entries can redirect or disrupt all DNS-dependent services downstream of the affected resolver. The E:P exploit maturity metric confirms proof-of-concept code exists, elevating practical risk above purely theoretical. No CISA KEV listing means confirmed widespread active exploitation has not been reported; however, the existence of CVE-2025-11411 as a related prior incomplete fix suggests this attack surface has been under active research. The combination of adjacent-network constraint and AT:P significantly limits opportunistic exploitation but does not eliminate targeted attacks against high-value DNS infrastructure such as ISP resolvers or enterprise recursive caches.

An attacker on the same network segment as an Unbound resolver-or capable of executing off-path DNS response spoofing or IP fragmentation injection-sends a crafted DNS reply containing a forged MX RRSet in the authority section with accompanying fabricated address records in the additional section, timed to win the DNS response race for an in-progress query. Because the authority RRSet appears as trusted in-zone delegation data, Unbound caches the poisoned address records and subsequently returns attacker-controlled IP addresses to clients resolving targeted domains. Publicly available proof-of-concept code (CVSS E:P) lowers the bar for executing this attack.