DNS Cache Poisoning via RRSIG Label Validation Bypass

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-44690 exploits insufficient validation of RRSIG.Labels fields in NLnet Labs Unbound DNS resolver versions 1.7.0 through 1.25.1, combined with premature cache writes during aggressive NSEC processing. This vulnerability allows an attacker controlling a single delegated zone under an NSEC-signed TLD to poison DNS cache entries for arbitrary sibling domains. The impact is severe: poisoned DNS responses can redirect users to attacker-controlled infrastructure, enabling phishing, malware distribution, and man-in-the-middle attacks at scale. Affected organizations include DNS resolver operators, ISPs, hosting providers, and enterprises running vulnerable Unbound instances in their DNS infrastructure. This attack requires minimal prerequisites—just one registered domain—making it a high-risk threat for organizations relying on these resolver versions.

Casky's 754 security skills leverage Claude AI's extended reasoning to detect the attack patterns mapped to MITRE ATT&CK techniques TA0001 (Reconnaissance), TA0043 (Reconnaissance via DNS), and TA0002 (Initial Access). Practitioners using Casky would identify suspicious indicators across 446 matching skills: anomalous RRSIG.Labels values in DNS query logs that deviate from RFC standards, premature cache entries appearing before normal validation completion, and lateral DNS responses where sibling zone records originate from unexpected authoritative servers. The platform would flag cache poisoning signatures—such as NSEC records with manipulated label counts or aggressive caching behavior inconsistent with zone configuration—enabling detection before users are redirected to malicious destinations. By correlating these findings with reconnaissance activity (abnormal DNS zone enumeration queries), practitioners can identify compromise chains and attribute attacks to single-domain threat actors.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-44690.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-44690

Casky has 446 skills that investigate the attack patterns behind CVE-2026-44690. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn