Cache poison in local-unbound service

What FreeBSD says

Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. If a malicious actor is able to attach such records in a reply they would be able to poison Unbound's cache for the delegation point.

Impact

A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done, for example, by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. FreeBSD 15.0 release candidates previously included a fix to mitigate the poison attempt. This advisory includes an additional fix to mitigate a poison attempt through YXDOMAIN and nodata non-referral answers. This advisory includes patches for FreeBSD 14.3-RELEASE and 13.5-RELEASE that cover both the original

Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.