CVE-2025-5994

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Unbound is an open source DNS server for the Netherlands NLnet team. NLnet Unbound has a security vulnerability that originates from the risk of cache poisoning when supporting EDNS Client Subnet, which may lead to Rebirthday attacks.(CVE-2025-5994)

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-5994: fix cache poisoning vulnerability by segregating outgoing queries to accommodate for different outgoing ECS information

• CVE-2025-5994: fix cache poisoning vulnerability by segregating outgoing queries to accommodate for different outgoing ECS information

• CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)
• CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)
• CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus
• CVE-2026-96405: add a per-packet budget for name decompression pointers
• CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit
• CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors

• CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)
• CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)
• CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus
• CVE-2026-96405: add a per-packet budget for name decompression pointers
• CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit
• CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

These are all security issues fixed in the libunbound8-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.

Xiang Li discovered that Unbound incorrectly handled EDNS Client Subnet (ECS) in certain configurations. A remote attacker could possibly use this issue to perform a cache poisoning attack called Rebirthday Attack.