CVE-2025-5994Acceptance of Extraneous Untrusted Data With Trusted Data in Labs Unbound

Severity
8.7HIGHNVD
EPSS
0.1%
top 78.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 16
Latest updateJul 22

Description

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries t

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

CVEListV5nlnet_labs/unbound1.6.21.23.0
Debiannlnetlabs/unbound< 1.13.1-1+deb11u5+3

🔴Vulnerability Details

3
OSV
CVE-2025-5994: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS)2025-07-16
CVEList
Cache poisoning via the ECS-enabled Rebirthday Attack2025-07-16
GHSA
GHSA-xrv5-2wwg-jp3r: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS)2025-07-16

📋Vendor Advisories

4
Ubuntu
Unbound vulnerabilities2025-07-22
Red Hat
unbound: Unbound Cache poisoning2025-07-16
Microsoft
Cache poisoning via the ECS-enabled Rebirthday Attack2025-07-08
Debian
CVE-2025-5994: unbound - A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been ...2025
CVE-2025-5994 — Nlnet Labs Unbound vulnerability | cvebase