CVE-2025-5994

Name
CVE-2025-5994
Description
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vendor-advisory https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html

Match rules

CPE URI Source package Min version Max version
unbound >= 1.6.2 < 1.23.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
unbound edge-main 1.23.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
unbound edge-main 1.22.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.21.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.20.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.19.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.19.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.16.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.16.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound edge-main 1.10.1-r0 None possibly vulnerable
unbound edge-main 1.9.5-r0 None possibly vulnerable
unbound edge-main 1.9.4-r0 None possibly vulnerable
unbound 3.22-main 1.23.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
unbound 3.22-main 1.21.1-r0 None possibly vulnerable
unbound 3.22-main 1.20.0-r0 None possibly vulnerable
unbound 3.22-main 1.19.2-r0 None possibly vulnerable
unbound 3.22-main 1.19.1-r0 None possibly vulnerable
unbound 3.22-main 1.16.3-r0 None possibly vulnerable
unbound 3.22-main 1.16.2-r0 None possibly vulnerable
unbound 3.22-main 1.10.1-r0 None possibly vulnerable
unbound 3.22-main 1.9.5-r0 None possibly vulnerable
unbound 3.22-main 1.9.4-r0 None possibly vulnerable
unbound 3.21-main 1.22.0-r1 Jakub Jirutka <jakub@jirutka.cz> fixed
unbound 3.21-main 1.22.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.21-main 1.21.1-r0 None possibly vulnerable
unbound 3.21-main 1.20.0-r0 None possibly vulnerable
unbound 3.21-main 1.19.2-r0 None possibly vulnerable
unbound 3.21-main 1.19.1-r0 None possibly vulnerable
unbound 3.21-main 1.16.3-r0 None possibly vulnerable
unbound 3.21-main 1.16.2-r0 None possibly vulnerable
unbound 3.21-main 1.10.1-r0 None possibly vulnerable
unbound 3.21-main 1.9.5-r0 None possibly vulnerable
unbound 3.21-main 1.9.4-r0 None possibly vulnerable
unbound 3.20-main 1.20.0-r2 Jakub Jirutka <jakub@jirutka.cz> fixed
unbound 3.20-main 1.20.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.20-main 1.20.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.20-main 1.19.2-r0 None possibly vulnerable
unbound 3.20-main 1.19.1-r0 None possibly vulnerable
unbound 3.20-main 1.16.3-r0 None possibly vulnerable
unbound 3.20-main 1.16.2-r0 None possibly vulnerable
unbound 3.20-main 1.10.1-r0 None possibly vulnerable
unbound 3.20-main 1.9.5-r0 None possibly vulnerable
unbound 3.20-main 1.9.4-r0 None possibly vulnerable
unbound 3.19-main 1.20.0-r2 Jakub Jirutka <jakub@jirutka.cz> fixed
unbound 3.19-main 1.20.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.19-main 1.20.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.19-main 1.19.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.19-main 1.19.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
unbound 3.19-main 1.16.3-r0 None possibly vulnerable
unbound 3.19-main 1.16.2-r0 None possibly vulnerable
unbound 3.19-main 1.10.1-r0 None possibly vulnerable
unbound 3.19-main 1.9.5-r0 None possibly vulnerable
unbound 3.19-main 1.9.4-r0 None possibly vulnerable