8.7
High
CVE-2025-5994 A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that…
Description
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| unbound 1.6 | 1.6.2 → < 1.23.0 | 1.23.0 |
Other CVEs of unbound
The 58 CVEs of unbound →
CVE-2026-97206
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable…
7.5
High
CVE-2026-96405
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual…
5.3
Medium
CVE-2026-50106
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional…
6.5
Medium
CVE-2026-35501
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an…
3.7
Low