CVE Explorer
CVE-2026-46582
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific re
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Unbound","vendor":"NLnet Labs","versions":[{"lessThan":"1.25.2","status":"affected","version":"1.6.0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:c9c5ea1670d83716776a48045bdfc1c24d8ad0e1ee2f8eb635bf5c3ebe7e0a3f · sha256:aa94a645cac93347… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:c9c5ea1670d83716776a48045bdfc1c24d8ad0e1ee2f8eb635bf5c3ebe7e0a3f · sha256:aa94a645cac93347… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-358","description":"CWE-358: Improperly Implemented Security Check for Standard","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:c9c5ea1670d83716776a48045bdfc1c24d8ad0e1ee2f8eb635bf5c3ebe7e0a3f · sha256:aa94a645cac93347… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-46582.txt"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c9c5ea1670d83716776a48045bdfc1c24d8ad0e1ee2f8eb635bf5c3ebe7e0a3f · sha256:aa94a645cac93347… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.