The flaw arises from insufficient validation of the RRSIG.Labels field and premature cache writes during RFC 8198 aggressive NSEC processing in Unbound 1.7.0 through 1.25.1. A resolver that accepts RRSIG labels that do not match the expected number of labels can cache bogus wildcard DS records that do not exist in the authoritative zone. When a single malicious zone within an NSEC‑signed parent domain is controlled by an attacker, the resolver will store the fraudulent wildcard delegations for sibling zones, effectively poisoning its DNS cache and allowing it to return forged answers to clients.

Unbound DNS resolver from NLnet Labs versions 1.7.0 through 1.25.1 are vulnerable. Versions newer than 1.25.1 include the fix that validates RRSIG labels and removes premature cache writes. The vulnerability also pertains to any environment using an NSEC‑signed parent domain that relies on Unbound for resolution.

The CVSS score of 7.5 indicates high severity while the EPSS score of less than 1 % indicates a very low but non‑zero probability of exploitation. The flaw is not catalogued in the CISA KEV list. Attackers need remote network access to a DNS resolver and control over a zone that is delegated under an NSEC‑signed parent. Once the cache is poisoned, the attacker can supply arbitrary DNS records for unrelated sibling zones, enabling traffic redirection, man‑in‑the‑middle attacks, or delivery of malicious content. The weakness is an input‑validation flaw (CWE‑345).