CVE-2026-54478

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.18.0 through 1.25.1

Description When the software listens on a 'proxy-protocol-port' interface with answer-cookie: yes, the RFC 9018 server-cookie SipHash is computed using the proxy's wire address rather than the PROXYv2-declared client. This allows a server cookie obtained via a proxy node to be valid for any PROXYv2-declared source behind that node. Consequently, an off-path attacker can harvest a cookie with one legitimate query and replay it using a spoofed source to bypass DNS Cookie checks.

Recommendations Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the answer-cookie setting or avoid using the 'proxy-protocol-port' interface.