CVE-2026-109125

Awaiting Analysis Awaiting Analysis - Queue

Cache Side-Channel in Unbound DNS Resolver

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: NLnet Labs

Description

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-109125

EUVD

EUVD-2026-107150

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet Labs	Unbound	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-205	The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Attack-Flow Graph

Executive Summary

CVE-2026-109125 is a cache-level side-channel vulnerability in NLnet Labs Unbound DNS software versions up to 1.26.1. It occurs when the unwanted-reply-threshold is set above 0. An attacker sends UDP datagrams with mismatched transaction IDs to the upstream source port of an active recursive query. When the count of such unwanted replies reaches the threshold, Unbound clears the worker's caches but leaves the pending upstream query intact. This allows an observer to detect if a candidate port matches the current upstream source port by checking for cache clears, enabling port probing and potential cache poisoning attacks.

Detection Guidance

Check if Unbound is running version 1.26.1 or earlier. Inspect the configuration for 'unwanted-reply-threshold' set to a value greater than 0. Monitor cache clearing events during high UDP traffic periods.

Impact Analysis

This vulnerability could allow an attacker to perform cache poisoning by first probing the upstream source port and then guessing the transaction ID (TXID) in a birthday-style attack. While default configurations and high thresholds make this difficult on public resolvers, attackers maintaining concurrent query windows could exploit it. Successful exploitation may redirect users to malicious sites or intercept sensitive DNS responses.

Compliance Impact

This vulnerability primarily impacts data integrity and confidentiality by enabling cache poisoning attacks through a side-channel exposure. While not directly tied to GDPR or HIPAA, such attacks could lead to unauthorized data exposure or manipulation, violating principles of data protection and integrity required by these regulations.

Mitigation Strategies

Upgrade Unbound to version 1.26.2 or later. If upgrading is not possible, apply the manual patch provided by NLnet Labs. Set 'unwanted-reply-threshold' to 0 as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-109125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...