Unbound DNS resolver up to version 1.25.0 accepts seemingly valid additional address records that accompany any authority RRSet, not just those for NS records. An attacker can forge a reply or use a fragmentation attack to inject such records, causing the resolver to cache them and potentially redirect clients to malicious servers. This flaw aligns with CWE‑349 and may compromise the confidentiality and integrity of DNS lookups.

Vendor NLnet Labs; product Unbound DNS resolver; affected versions include all releases through 1.25.0. The vendor released version 1.25.1 with a fix that rejects irrelevant address records in the additional section for authority RRSets, mitigating the poison effect.

The CVSS score of 5.7 indicates moderate severity. The exploitation vector is remote, requiring the ability to spoof or fragment packets destined for the resolver. No EPSS data is available, and the vulnerability is not listed in the KEV catalog, suggesting limited documented exploitation. However, the attack path is straightforward for an adversary able to control network traffic to Unbound, making timely remediation advisable.