Read the docs
TI-2026-78614 Aliases CVE-2026-109125GHSA-66rc-377g-m4m4

Cache side-channel in NLnet Labs Unbound leaks upstream source port

Priority LOW 23CWE-205Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NLnet Labs Unbound before 1.26.2 is affected when unwanted-reply-threshold is set above 0, which is not a default configuration. When unmatched UDP replies reach the threshold, Unbound clears its RRset and message caches while the pending upstream query survives, so an external observer can tell whether a guessed port matches the upstream source port (CWE-205). An attacker who can keep a concurrent query window open could use this to filter the source port and then guess the TXID to poison the cache, although the suggested threshold makes this unreliable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed Unbound (NLnet Labs): 1.26.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NLnet LabsUnboundbefore 1.26.21.26.2Patch availableCNA
  • Unbound VendorNLnet Labs Affected before 1.26.2 Fixed in 1.26.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*——NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* Versions — — ·NLNETLABS

Remediation

Update NLnet Labs Unbound to version 1.26.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Unbound (NLnet Labs) Fixed in 1.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NLnet Labs Unbound 1.26.2

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-78586 Unbound DoQ path migration use-after-free on multi-threaded deploymentsPriority LOW 39
    • TI-2026-78584 Unbound resolver lacks aggregate limit on DNS compression pointersPriority LOW 30
    • TI-2026-78546 Unbound NXDOMAIN denial for island trust anchor under insecure parentPriority LOW 28
    Show all 5 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-109125
  2. 2026-10-21 Alias added: GHSA-66rc-377g-m4m4
  3. 2026-10-29 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
  • TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
  • TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
  • TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
  • TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
  • TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences