Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs
CVE-2026-54478DNS Cookie bypass when combined with proxy-protocol use
Low 3.7
In plain English
A low-severity authentication bypass by spoofing in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-54478 |
| Alpine:v3.23 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-54478 |
| Alpine:v3.24 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-54478 |
| Debian:12 | unbound | no fix listed | DEBIAN-CVE-2026-54478 |
| Debian:13 | unbound | 1.26.1-0+deb13u1 | DEBIAN-CVE-2026-54478 |
| Debian:14 | unbound | 1.25.2-1 | DEBIAN-CVE-2026-54478 |
| Ubuntu:22.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-54478 |
| Ubuntu:24.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-54478 |
| Ubuntu:26.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-54478 |
| Ubuntu:26.10 | unbound | no fix listed | UBUNTU-CVE-2026-54478 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 1.18.0 – before 1.25.2 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt vendor-advisory