CVE catalog

CVE-2025-5994

Unbound vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunboundsid1.26.2-1fixed
Debianunboundforky1.26.2-1fixed
Debianunboundtrixie1.22.0-2+deb13u3fixed
Debianunboundtrixie-security1.26.2-0+deb13u1fixed
Debianunboundbookworm1.17.1-2+deb12u4fixed
Debianunboundbookworm-security1.17.1-2+deb12u3fixed
Ubuntuunboundnoble1.19.2-1ubuntu3.5fixed
Ubuntulibunbound-devnoble1.19.2-1ubuntu3.5fixed
Ubuntulibunbound8noble1.19.2-1ubuntu3.5fixed
Ubuntupython3-unboundnoble1.19.2-1ubuntu3.5fixed
Ubuntuunbound-anchornoble1.19.2-1ubuntu3.5fixed
Ubuntuunbound-hostnoble1.19.2-1ubuntu3.5fixed
Ubuntuunboundpro1.9.0-2ubuntu1vulnerable
Ubuntuunboundpro1.9.0-2ubuntu2vulnerable
Ubuntuunboundpro1.9.4-2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.3vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.4vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.5vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.6vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.8vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.9vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11fixed
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5fixed
Ubuntuunbound25.101.22.0-1ubuntu1vulnerable
Ubuntuunbound25.101.22.0-2ubuntu1fixed
Alpineunbound3.191.20.0-r2fixed
Alpineunbound3.201.20.0-r2fixed
Alpineunbound3.211.22.0-r1fixed
Alpineunbound3.221.23.1-r0fixed
Alpineunbound3.231.23.1-r0fixed
Alpineunbound3.241.23.1-r0fixed
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11fixed
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5fixed
Opensuseunboundtumbleweed1.23.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunboundsourcesid1.22.0-2not yet assignedNot reported[1109427]
Debianunboundsourceforky1.22.0-2not yet assignedNot reported[1109427]
Debianunboundsourcetrixie1.22.0-2not yet assignedNot reported[1109427]
Debianunboundsourcebookworm1.17.1-2+deb12u3not yet assignedNot reported[1109427]
Ubuntuunbounddebnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntulibunbound-devdebnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntulibunbound8debnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntupython3-unbounddebnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntuunbound-anchordebnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntuunbound-hostdebnoble1.19.2-1ubuntu3.5Not reportedNot reportedNot reported
Ubuntuunbounddeb22.041.13.1-1ubuntu5.11Not reportedUBUNTU-CVE-2025-5994Not reported
Ubuntuunbounddeb24.041.19.2-1ubuntu3.5Not reportedUBUNTU-CVE-2025-5994Not reported
Ubuntuunbounddeb25.101.22.0-2ubuntu1Not reportedUBUNTU-CVE-2025-5994Not reported
Alpineunboundapk3.191.20.0-r2Not reportedALPINE-CVE-2025-5994Not reported
Alpineunboundapk3.201.20.0-r2Not reportedALPINE-CVE-2025-5994Not reported
Alpineunboundapk3.211.22.0-r1Not reportedALPINE-CVE-2025-5994Not reported
Alpineunboundapk3.221.23.1-r0Not reportedALPINE-CVE-2025-5994Not reported
Alpineunboundapk3.231.23.1-r0Not reportedALPINE-CVE-2025-5994Not reported
Alpineunboundapk3.241.23.1-r0Not reportedALPINE-CVE-2025-5994Not reported
Ubuntuunbounddeb22.041.13.1-1ubuntu5.11Not reportedUSN-7666-1Not reported
Ubuntuunbounddeb24.041.19.2-1ubuntu3.5Not reportedUSN-7666-1Not reported
Opensuseunboundrpmtumbleweed1.23.1-1.1Not reportedOPENSUSE-SU-2025:15435-1Not reported

[Debian bug #1109427]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libunbound8]Unknown

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.1-1.1

      Version impact unknown

      usn · unbound · opensuse · tumbleweed

  • [python3-unbound]Unknown

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.1-1.1

      Version impact unknown

      usn · unbound · opensuse · tumbleweed

  • [unbound-anchor]Unknown

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.1-1.1

      Version impact unknown

      usn · unbound · opensuse · tumbleweed

  • [unbound-devel]Unknown

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.1-1.1

      Version impact unknown

      usn · unbound · opensuse · tumbleweed

  • [unbound-munin]Unknown

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · noarch · tumbleweed

      Unknown · Fixed: 1.23.1-1.1

      Version impact unknown

      usn · unbound · opensuse · tumbleweed

  • [unbound]Fixed

    Source package: [unbound]

    Details (1)

    • 1.26.0-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.23.1-1.1

      usn · unbound · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libunbound8]Fixed

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

  • [libunbound-dev]Fixed

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

  • [python3-unbound]Fixed

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

  • [unbound]Fixed
    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

  • [unbound-anchor]Fixed

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

  • [unbound-host]Fixed

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.17.1-2+deb12u3

      usn · unbound · debian · bookworm; usn · unbound · debian · 12

[Debian 13 (Trixie)]

  • [libunbound8]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

  • [libunbound-dev]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

  • [python3-unbound]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

  • [unbound]Fixed
    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

  • [unbound-anchor]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

  • [unbound-host]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2

      usn · unbound · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]