8.7

CVE-2025-5994: nlnet labs unbound

CVSS: 8.7v4.0HighDeferred
AliasesALPINE-CVE-2025-5994RHSA-2025:11849RHSA-2025:11884
Published 16-07-2025Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2025-5994 is a high (CVSS 8.7) vulnerability in nlnet labs unbound. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.5% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.22%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2
DLA-4280-1DSA-5987-1

Timeline

  1. 16-07-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

CVSS metrics

6 scores · 6 sources · 2 versions

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

+0.02 pp

From 0.20% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat12 products
  • python3-unbound< 0:1.16.2-19.el9_6.1 | < 0:1.16.2-5.9.el8_10 | < 0:1.20.0-12.el10_0 | < 0:1.16.2-8.el9_4.2 | < 0:1.13.1-13.el9_0.5 | < 0:1.16.2-3.el9_2.5 | < 0:1.16.2-5.el8_8.5 | < 0:1.7.3-15.el8_4.2 | < 0:1.7.3-12.el8_2.2 | < 0:1.7.3-17.el8_6.6
  • python3-unbound-debuginfo< 0:1.16.2-19.el9_6.1 | < 0:1.16.2-5.9.el8_10 | < 0:1.20.0-12.el10_0 | < 0:1.16.2-8.el9_4.2 | < 0:1.13.1-13.el9_0.5 | < 0:1.16.2-3.el9_2.5 | < 0:1.16.2-5.el8_8.5 | < 0:1.7.3-15.el8_4.2 | < 0:1.7.3-12.el8_2.2 | < 0:1.7.3-17.el8_6.6
  • unbound< 0:1.16.2-19.el9_6.1 | < 0:1.16.2-5.9.el8_10 | < 0:1.20.0-12.el10_0 | < 0:1.16.2-8.el9_4.2 | < 0:1.13.1-13.el9_0.5 | < 0:1.16.2-3.el9_2.5 | < 0:1.16.2-5.el8_8.5 | < 0:1.7.3-15.el8_4.2 | < 0:1.7.3-12.el8_2.2 | < 0:1.7.3-17.el8_6.6
  • unbound-anchor< 0:1.20.0-12.el10_0
  • unbound-anchor-debuginfo< 0:1.20.0-12.el10_0
Alpine1 product
  • unbound< 1.20.0-r2 | < 1.22.0-r1 | < 1.23.1-r0
Debian1 product
  • unbound< 1.17.1-2+deb12u3 | < 1.22.0-2
Nlnet labs1 product
Opensuse1 product
  • unbound&distro=openSUSE Tumbleweed< 1.23.1-1.1
Ubuntu1 product
  • unboundAll versions (No fix recorded) | < 1.22.0-2ubuntu1 | < 1.13.1-1ubuntu5.11 | < 1.19.2-1ubuntu3.5

6 vendors · 17 products

References

32 links
Show all 32 references