Vulnerability · Published Jul 16, 2025 · Assigned by NLnet Labs
CVE-2025-5994Cache poisoning via the ECS-enabled Rebirthday Attack
High 8.7
In plain English
A high-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | python3-unbound | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:8 | python3-unbound | 1.16.2-5.9.el8_10 | ALSA-2025:11884 |
| AlmaLinux:9 | python3-unbound | 1.16.2-19.el9_6.1 | ALSA-2025:11849 |
| AlmaLinux:10 | unbound | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:8 | unbound | 1.16.2-5.9.el8_10 | ALSA-2025:11884 |
| AlmaLinux:9 | unbound | 1.16.2-19.el9_6.1 | ALSA-2025:11849 |
| AlmaLinux:10 | unbound-anchor | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:10 | unbound-devel | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:8 | unbound-devel | 1.16.2-5.9.el8_10 | ALSA-2025:11884 |
| AlmaLinux:9 | unbound-devel | 1.16.2-19.el9_6.1 | ALSA-2025:11849 |
| AlmaLinux:10 | unbound-dracut | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:9 | unbound-dracut | 1.16.2-19.el9_6.1 | ALSA-2025:11849 |
| AlmaLinux:10 | unbound-libs | 1.20.0-12.el10_0 | ALSA-2025:12064 |
| AlmaLinux:8 | unbound-libs | 1.16.2-5.9.el8_10 | ALSA-2025:11884 |
| AlmaLinux:9 | unbound-libs | 1.16.2-19.el9_6.1 | ALSA-2025:11849 |
| Alpine:v3.20 | unbound | 1.20.0-r2 | ALPINE-CVE-2025-5994 |
| Alpine:v3.21 | unbound | 1.22.0-r1 | ALPINE-CVE-2025-5994 |
| Alpine:v3.22 | unbound | 1.23.1-r0 | ALPINE-CVE-2025-5994 |
| Alpine:v3.23 | unbound | 1.23.1-r0 | ALPINE-CVE-2025-5994 |
| Alpine:v3.24 | unbound | 1.23.1-r0 | ALPINE-CVE-2025-5994 |
| Debian:12 | unbound | 1.17.1-2+deb12u3 | DEBIAN-CVE-2025-5994 |
| Debian:12 | unbound | 1.17.1-2+deb12u3 | DSA-5987-1 |
| Debian:13 | unbound | 1.22.0-2 | DEBIAN-CVE-2025-5994 |
| Debian:14 | unbound | 1.22.0-2 | DEBIAN-CVE-2025-5994 |
| Rocky Linux:8 | unbound | 0:1.16.2-5.9.el8 | RLSA-2025:11884 |
| Rocky Linux:9 | unbound | 0:1.16.2-19.el9_6.1 | RLSA-2025:11849 |
| Ubuntu:22.04:LTS | unbound | 1.13.1-1ubuntu5.11 | USN-7666-1 |
| Ubuntu:22.04:LTS | unbound | 1.13.1-1ubuntu5.11 | UBUNTU-CVE-2025-5994 |
| Ubuntu:24.04:LTS | unbound | 1.19.2-1ubuntu3.5 | USN-7666-1 |
| Ubuntu:24.04:LTS | unbound | 1.19.2-1ubuntu3.5 | UBUNTU-CVE-2025-5994 |
| Ubuntu:25.10 | unbound | 1.22.0-2ubuntu1 | UBUNTU-CVE-2025-5994 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 1.6.2 – before 1.23.0 |
Weakness: CWE-349 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C