CVE-2026-109125

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2

Description An observable cache-level side-channel exists when the unwanted-reply-threshold is configured to a value greater than 0. This occurs when a response-like UDP datagram reaches the upstream source port of a recursive query but has a TXID that does not match any pending query, causing Unbound to count it as an unwanted reply. Once the accumulated count reaches the configured threshold, the worker's RRset cache and message cache are cleared without destroying the current upstream UDP pending query. An external observer can use this behavior to determine if a candidate port matches the current upstream source port by monitoring if cached items are cleared. This side-channel can be used to probe the upstream source port and, in scenarios where a concurrent query window is maintained, facilitate birthday-style guessing against the TXID to enable cache poisoning.

Recommendations Update NLnet Labs Unbound to version 1.26.2 or later. As a temporary mitigation, ensure the unwanted-reply-threshold is not set to a value greater than 0.