CVE-2026-54478
Received Received - Intake

Cookie Reuse Vulnerability in Unbound DNS Server

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-54478
EUVD
EUVD-2026-47678

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54478 is a flaw in NLnet Labs Unbound DNS software where the server-cookie SipHash is incorrectly computed using the proxy's wire address instead of the actual client's IP address declared in the PROXYv2 protocol. This happens when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes' enabled.

Detection Guidance

Check Unbound version with 'unbound -V' to confirm if it is between 1.18.0 and 1.25.1. Inspect configuration for 'proxy-protocol-port' and 'answer-cookie: yes' settings. Monitor DNS traffic for repeated cookie reuse from different sources.

Impact Analysis

An off-path attacker can harvest a valid server cookie with one legitimate query and reuse it for any spoofed source address. This bypasses DNS Cookie checks meant to prevent such attacks, potentially allowing unauthorized DNS queries or cache poisoning.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it relates to DNS server cookie handling rather than data protection or privacy controls. However, if exploited, it could enable unauthorized DNS queries, potentially leading to data exfiltration or integrity issues, which may indirectly impact compliance in environments where DNS logging and integrity are required by these standards.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, disable 'answer-cookie: yes' or remove 'proxy-protocol-port' configuration. Apply the patch provided by NLnet Labs if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart