Read the docs
TI-2025-05415 Aliases CVE-2025-5994GHSA-xrv5-2wwg-jp3r

Cache poisoning via the ECS-enabled Rebirthday Attack

Priority MEDIUM 43CWE-349Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 26 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Partial Unbound (NLnet Labs): 1.23.0Red Hat: 19 advisoriesRed Hat: 26 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NLnet LabsUnbound1.6.2 to before 1.23.01.23.0Patch availableCNA
  • Unbound VendorNLnet Labs Affected 1.6.2 to before 1.23.0 Fixed in 1.23.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*——NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* Versions — — ·NLNETLABS

Remediation

  • Fix · CNA Unbound (NLnet Labs) Fixed in 1.23.0

Red Hat 19 advisories

  • RHSA-2026:67857 Released 2026-09-28 · Red Hat rating Important
    OpenShift Container Platform 4.15.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202609140326-0, rhcos-ppc64le-415.92.202609140326-0, rhcos-s390x-415.92.202609140326-0 +1
  • RHSA-2026:62549 Released 2026-09-10 · Red Hat rating Important
    OpenShift Container Platform 4.16.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202609011112-0, rhcos-ppc64le-416.94.202609011112-0, rhcos-s390x-416.94.202609011112-0 +1
  • RHSA-2025:19894 Released 2025-11-13 · Red Hat rating Important
    OpenShift Container Platform 4.12.82 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202510291903-0
Show 16 more Red Hat advisories
  • RHSA-2025:19041 Released 2025-10-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202510211419-0, rhcos-ppc64le-414.92.202510211419-0, rhcos-s390x-414.92.202510211419-0 +1
  • RHSA-2025:19046 Released 2025-10-29 · Red Hat rating Important
    OpenShift Container Platform 4.18.27 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202510230424-0, rhcos-ppc64le-418.94.202510230424-0, rhcos-s390x-418.94.202510230424-0 +1
  • RHSA-2025:18240 Released 2025-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202510150118-0
  • RHSA-2025:18217 Released 2025-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.19.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202510140714-0, rhcos-ppc64le-4.19.9.6.202510140714-0, rhcos-s390x-4.19.9.6.202510140714-0 +1
  • RHSA-2025:18218 Released 2025-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202510112152-0, rhcos-ppc64le-417.94.202510112152-0, rhcos-s390x-417.94.202510112152-0 +1
  • RHSA-2025:15397 Released 2025-10-21 · Red Hat rating Important
    OpenShift Container Platform 4.20.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202509251656-0, rhcos-ppc64le-4.20.9.6.202509251656-0, rhcos-s390x-4.20.9.6.202509251656-0 +1
  • RHSA-2025:13577 Released 2025-08-11 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) python3-unbound-1.7.3-17.el8_6.6, unbound-1.7.3-17.el8_6.6, unbound-devel-1.7.3-17.el8_6.6 +1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) python3-unbound-1.7.3-17.el8_6.6, unbound-1.7.3-17.el8_6.6, unbound-devel-1.7.3-17.el8_6.6 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) python3-unbound-1.7.3-17.el8_6.6, unbound-1.7.3-17.el8_6.6, unbound-devel-1.7.3-17.el8_6.6 +1
  • RHSA-2025:13575 Released 2025-08-11 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) python3-unbound-1.7.3-15.el8_4.2, unbound-1.7.3-15.el8_4.2, unbound-devel-1.7.3-15.el8_4.2 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python3-unbound-1.7.3-15.el8_4.2, unbound-1.7.3-15.el8_4.2, unbound-devel-1.7.3-15.el8_4.2 +1
  • RHSA-2025:13576 Released 2025-08-11 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) python3-unbound-1.7.3-12.el8_2.2, unbound-1.7.3-12.el8_2.2, unbound-devel-1.7.3-12.el8_2.2 +1
  • RHSA-2025:12929 Released 2025-08-05 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3-unbound-1.16.2-5.el8_8.5, unbound-1.16.2-5.el8_8.5, unbound-devel-1.16.2-5.el8_8.5 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3-unbound-1.16.2-5.el8_8.5, unbound-1.16.2-5.el8_8.5, unbound-devel-1.16.2-5.el8_8.5 +1
  • RHSA-2025:12523 Released 2025-08-04 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3-unbound-1.16.2-3.el9_2.5, unbound-1.16.2-3.el9_2.5, unbound-libs-1.16.2-3.el9_2.5
  • RHSA-2025:12520 Released 2025-08-04 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) python3-unbound-1.13.1-13.el9_0.5, unbound-1.13.1-13.el9_0.5, unbound-libs-1.13.1-13.el9_0.5
  • RHSA-2025:12416 Released 2025-07-31 · Red Hat rating Important
    unbound security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) unbound-devel-1.16.2-8.el9_4.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3-unbound-1.16.2-8.el9_4.2, unbound-1.16.2-8.el9_4.2, unbound-libs-1.16.2-8.el9_4.2
  • RHSA-2025:12064 Released 2025-07-29 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3-unbound-1.20.0-12.el10_0, unbound-1.20.0-12.el10_0, unbound-anchor-1.20.0-12.el10_0 +2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) unbound-devel-1.20.0-12.el10_0
  • RHSA-2025:11884 Released 2025-07-28 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3-unbound-1.16.2-5.9.el8_10, unbound-1.16.2-5.9.el8_10, unbound-devel-1.16.2-5.9.el8_10 +1
  • RHSA-2025:11849 Released 2025-07-28 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3-unbound-1.16.2-19.el9_6.1, unbound-1.16.2-19.el9_6.1, unbound-dracut-1.16.2-19.el9_6.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) unbound-devel-1.16.2-19.el9_6.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:12416
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:12064
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:11884
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:11849
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:13576
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:13575
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:13577
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:13577
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:12929
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:12520
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:12523
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:12416
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:13575
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:13577
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:12929
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:12064
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:11849
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:19894
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:18240
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:19041
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:67857
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:62549
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:18218
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:19046
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:18217
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2025:15397

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5994
  2. 2026-10-03 Alias added: GHSA-xrv5-2wwg-jp3r
  3. 2026-10-09 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
  • TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
  • TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
  • TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
  • TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
  • TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences