Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Unbound and other caching resolvers are vulnerable to DNS cache poisoning

CVE-2025-5994 · published 1 year ago
Summary

A security weakness has been found in some DNS servers that could allow attackers to manipulate user requests. This affects Unbound and other caching resolvers that help speed up DNS lookups. To fix this issue, ensure that these servers are not configured to send certain information that makes them vulnerable to this attack.

What to do
  • Update canonical unbound to version 1.13.1-1ubuntu5.11.
  • Update canonical unbound to version 1.19.2-1ubuntu3.5.
  • Update canonical unbound to version 1.22.0-2ubuntu1.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:14.04:LTS canonical unbound All versions
Ubuntu:Pro:16.04:LTS canonical unbound All versions
Ubuntu:Pro:18.04:LTS canonical unbound All versions
Ubuntu:Pro:20.04:LTS canonical unbound All versions
Ubuntu:22.04:LTS canonical unbound < 1.13.1-1ubuntu5.11
Fix: upgrade to 1.13.1-1ubuntu5.11
Ubuntu:24.04:LTS canonical unbound < 1.19.2-1ubuntu3.5
Fix: upgrade to 1.19.2-1ubuntu3.5
Ubuntu:25.10 canonical unbound < 1.22.0-2ubuntu1
Fix: upgrade to 1.22.0-2ubuntu1
Original advisory text
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ...
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
Timeline
Published17 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-5994 · NVD
UBUNTU-CVE-2025-5994 · OSV
Track software like this
Free during beta