{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46582 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-46582 is a low-severity vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-46582 and fix it if it is affected.\n\nWhat it is: CVE-2026-46582 is a low-severity vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-46582 in the wild and no public exploit code.\n\nAffected product: Nlnetlabs Unbound. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46582/ (Markdown: https://insights.sbomify.com/CVE-2026-46582/index.md)","id":"CVE-2026-46582","markdown":"https://insights.sbomify.com/CVE-2026-46582/index.md","name":"CVE-2026-46582","record":{"aliases":["ALPINE-CVE-2026-46582","AZL-92961","DEBIAN-CVE-2026-46582","ECHO-6f41-ec39-7f1e","GHSA-cj23-2crp-2xvv","UBUNTU-CVE-2026-46582"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"DNS resolver","requires_auth":"none","summary":"Attackers can poison DNS cache entries in Unbound's serve-expired mode by exploiting a race condition in wildcard validation, altering resolved records.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"NLnet Labs","cpe":[{"product":"unbound","vendor":"nlnetlabs"}],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-358","name":"Improperly Implemented Security Check for Standard"}],"description":"In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path","id":"CVE-2026-46582","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"nlnetlabs:unbound","products":["nlnetlabs:unbound"],"type":"other","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties","id":"CVE-2026-46584"},"packages":[],"prev":{"headline":"Server-side request forgery in Eclipse Mojarra","id":"CVE-2026-46581"},"products":["Unbound"],"published":"2026-07-22","related":[{"cvss_score":9.1,"headline":"Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY","id":"CVE-2026-81642","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":9.1,"headline":"Possible arbitrary code execution during DNSSEC validation","id":"CVE-2026-33278","kev_date_added":null,"published":"2026-05-20"},{"cvss_score":8.7,"headline":"Heap overflow with multiple NSID, COOKIE, PADDING EDNS options","id":"CVE-2026-42944","kev_date_added":null,"published":"2026-05-20"},{"cvss_score":8.7,"headline":"Crash during DNSSEC validation of malicious content","id":"CVE-2026-42959","kev_date_added":null,"published":"2026-05-20"},{"cvss_score":8.4,"headline":"CNAME synthesis could lead to heap corruption","id":"CVE-2026-82717","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":7.5,"headline":"Possible heap buffer overflow during DNSSEC canonicalization","id":"CVE-2026-81634","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":7.5,"headline":"Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass","id":"CVE-2026-32665","kev_date_added":null,"published":"2026-07-22"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-22","vendors":["NLnet Labs"]},"summary":"Attackers can poison DNS cache entries in Unbound's serve-expired mode by exploiting a race condition in wildcard validation, altering resolved records.","url":"https://insights.sbomify.com/CVE-2026-46582/"}