Skip to content
Fencer Vulns
high 8.7

CVE-2025-5994 json

Cache poisoning via the ECS-enabled Rebirthday Attack

published 2025-07-16 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21730

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

Patch / fix

  • NLnet Labs Unbound 1.23.0
  • unbound Debian 12 1.17.1-2+deb12u3
  • unbound Debian 14, Debian 13 1.22.0-2

debian advisories DEBIAN-CVE-2025-5994

  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.11
  • unbound Ubuntu 24.04 LTS 1.19.2-1ubuntu3.5
  • unbound Ubuntu 25.10 1.22.0-2ubuntu1

ubuntu advisories UBUNTU-CVE-2025-5994

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound RHEL 10.0 1.20.0-12.el10_0
  • unbound-libs RHEL 10.0 1.20.0-12.el10_0
  • unbound-anchor RHEL 10.0 1.20.0-12.el10_0
  • unbound-dracut RHEL 10.0 1.20.0-12.el10_0
  • python3-unbound RHEL 10.0 1.20.0-12.el10_0
  • unbound RHEL 8 1.16.2-5.9.el8_10
  • unbound-libs RHEL 8 1.16.2-5.9.el8_10
  • python3-unbound RHEL 8 1.16.2-5.9.el8_10

red hat advisories RHSA-2025:13577RHSA-2025:13575RHSA-2025:13576RHSA-2025:12929RHSA-2025:12523RHSA-2025:12520

  • unbound openSUSE Tumbleweed 1.23.1-1.1

opensuse advisories openSUSE-SU-2025:15435-1

  • unbound AlmaLinux 10 1.20.0-12.el10_0
  • unbound-libs AlmaLinux 10 1.20.0-12.el10_0
  • unbound-anchor AlmaLinux 10 1.20.0-12.el10_0
  • unbound-dracut AlmaLinux 10 1.20.0-12.el10_0
  • python3-unbound AlmaLinux 10 1.20.0-12.el10_0
  • unbound AlmaLinux 9 1.16.2-19.el9_6.1
  • unbound-libs AlmaLinux 9 1.16.2-19.el9_6.1
  • unbound-dracut AlmaLinux 9 1.16.2-19.el9_6.1

almalinux advisories ALSA-2025:12064ALSA-2025:11849ALSA-2025:11884

  • unbound Rocky Linux 8 1.16.2-5.9.el8
  • unbound Rocky Linux 9 1.16.2-19.el9_6.1

rocky linux advisories RLSA-2025:11884RLSA-2025:11849

  • unbound Alpine 3.20, Alpine 3.19 1.20.0-r2
  • unbound Alpine 3.21 1.22.0-r1
  • unbound Alpine 3.24, Alpine 3.23, Alpine 3.22 1.23.1-r0

alpine advisories ALPINE-CVE-2025-5994

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-5994 updated cvss 7.5

unbound: Unbound Cache poisoning

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) unbound-devel 1.16.2-8.el9_4.2, unbound-debuginfo 1.16.2-8.el9_4.2, unbound-debugsource 1.16.2-8.el9_4.2, unbound-libs-debuginfo 1.16.2-8.el9_4.2, python3-unbound-debuginfo 1.16.2-8.el9_4.2
    fixed: vendor fix RHSA-2025:12416
  • Red Hat Enterprise Linux AppStream (v. 8) unbound 1.16.2-5.9.el8_10, unbound-libs 1.16.2-5.9.el8_10, python3-unbound 1.16.2-5.9.el8_10
    fixed: vendor fix RHSA-2025:11884
  • Red Hat Enterprise Linux AppStream (v. 9) unbound 1.16.2-19.el9_6.1, unbound-libs 1.16.2-19.el9_6.1, unbound-dracut 1.16.2-19.el9_6.1, python3-unbound 1.16.2-19.el9_6.1
    fixed: vendor fix RHSA-2025:11849
  • Red Hat Enterprise Linux AppStream (v. 10) unbound 1.20.0-12.el10_0, unbound-libs 1.20.0-12.el10_0, unbound-anchor 1.20.0-12.el10_0, unbound-dracut 1.20.0-12.el10_0, python3-unbound 1.20.0-12.el10_0
    fixed: vendor fix RHSA-2025:12064
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) unbound 1.7.3-12.el8_2.2, unbound-libs 1.7.3-12.el8_2.2, python3-unbound 1.7.3-12.el8_2.2
    fixed: vendor fix RHSA-2025:13576
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) unbound 1.7.3-15.el8_4.2, unbound-libs 1.7.3-15.el8_4.2, python3-unbound 1.7.3-15.el8_4.2
    fixed: vendor fix RHSA-2025:13575
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) unbound 1.7.3-17.el8_6.6, unbound-libs 1.7.3-17.el8_6.6, python3-unbound 1.7.3-17.el8_6.6 Red Hat Enterprise Linux AppStream E4S (v.8.6) unbound 1.7.3-17.el8_6.6, unbound-libs 1.7.3-17.el8_6.6, python3-unbound 1.7.3-17.el8_6.6
    fixed: vendor fix RHSA-2025:13577
show 18 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) unbound 1.16.2-5.el8_8.5, unbound-libs 1.16.2-5.el8_8.5, python3-unbound 1.16.2-5.el8_8.5
    fixed: vendor fix RHSA-2025:12929
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) unbound 1.13.1-13.el9_0.5, unbound-libs 1.13.1-13.el9_0.5, python3-unbound 1.13.1-13.el9_0.5
    fixed: vendor fix RHSA-2025:12520
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) unbound 1.16.2-3.el9_2.5, unbound-libs 1.16.2-3.el9_2.5, python3-unbound 1.16.2-3.el9_2.5
    fixed: vendor fix RHSA-2025:12523
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) unbound 1.16.2-8.el9_4.2, unbound-libs 1.16.2-8.el9_4.2, python3-unbound 1.16.2-8.el9_4.2
    fixed: vendor fix RHSA-2025:12416
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) unbound 1.7.3-15.el8_4.2, unbound-libs 1.7.3-15.el8_4.2, python3-unbound 1.7.3-15.el8_4.2
    fixed: vendor fix RHSA-2025:13575
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) unbound 1.7.3-17.el8_6.6, unbound-libs 1.7.3-17.el8_6.6, python3-unbound 1.7.3-17.el8_6.6
    fixed: vendor fix RHSA-2025:13577
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) unbound 1.16.2-5.el8_8.5, unbound-libs 1.16.2-5.el8_8.5, python3-unbound 1.16.2-5.el8_8.5
    fixed: vendor fix RHSA-2025:12929
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) unbound-devel 1.16.2-19.el9_6.1, unbound-debuginfo 1.16.2-19.el9_6.1, unbound-debugsource 1.16.2-19.el9_6.1, unbound-libs-debuginfo 1.16.2-19.el9_6.1, python3-unbound-debuginfo 1.16.2-19.el9_6.1
    fixed: vendor fix RHSA-2025:11849
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) unbound-devel 1.20.0-12.el10_0, unbound-debuginfo 1.20.0-12.el10_0, unbound-debugsource 1.20.0-12.el10_0, unbound-libs-debuginfo 1.20.0-12.el10_0, unbound-utils-debuginfo 1.20.0-12.el10_0, unbound-anchor-debuginfo 1.20.0-12.el10_0, +1 more
    fixed: vendor fix RHSA-2025:12064
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202510291903
    fixed: vendor fix RHSA-2025:19894
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202510150118
    fixed: vendor fix RHSA-2025:18240
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202510211419
    fixed: vendor fix RHSA-2025:19041
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202609140326
    fixed: vendor fix RHSA-2026:67857
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202609011112
    fixed: vendor fix RHSA-2026:62549
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202510112152
    fixed: vendor fix RHSA-2025:18218
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202510230424
    fixed: vendor fix RHSA-2025:19046
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202510140714
    fixed: vendor fix RHSA-2025:18217
  • Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202509251656
    fixed: vendor fix RHSA-2025:15397

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:X/U:X

Affected products

  • NLnet Labs Unbound

Classification

Weakness
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.