Created attachment 265665 [details] patch to update This security release has additional fixes for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. The CVE is described here https://nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt Unbound 1.24.1 included a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies as well, mitigating the possible poison effect. We would like to thank TaoFei Guo from Peking University, Yang Luo and JianJun Chen from Tsinghua University for discovering and responsibly disclosing the partial mitigation of CVE-2025-11411 in Unbound 1.24.1. Bug Fixes: - Additional fix for CVE-2025-11411 (possible domain hijacking attack), to include YXDOMAIN and non-referral nodata answers in the mitigation as well, reported by TaoFei Guo from Peking University, Yang Luo and JianJun Chen from Tsinghua University.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=f4188ecfbeb4e406838684c46178a9b4fc32d4c2 commit f4188ecfbeb4e406838684c46178a9b4fc32d4c2 Author: Jaap Akkerhuis <jaap@NLnetLabs.nl> AuthorDate: 2025-11-26 13:12:58 +0000 Commit: Li-Wen Hsu <lwhsu@FreeBSD.org> CommitDate: 2025-11-26 14:22:08 +0000 dns/unbound: Update to 1.24.2 This security release has additional fixes for CVE-2025-11411. PR: 291236 dns/unbound/Makefile | 2 +- dns/unbound/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
A commit in branch 2025Q4 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=ff79a1fe954c7d50a40f6a795222273dc4d39cfe commit ff79a1fe954c7d50a40f6a795222273dc4d39cfe Author: Jaap Akkerhuis <jaap@NLnetLabs.nl> AuthorDate: 2025-11-26 13:12:58 +0000 Commit: Li-Wen Hsu <lwhsu@FreeBSD.org> CommitDate: 2025-11-26 14:22:57 +0000 dns/unbound: Update to 1.24.2 This security release has additional fixes for CVE-2025-11411. PR: 291236 (cherry picked from commit f4188ecfbeb4e406838684c46178a9b4fc32d4c2) dns/unbound/Makefile | 2 +- dns/unbound/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
thank you for pushing this through so quickly :)