CVE-2025-5994 Cache poisoning via the ECS-enabled Rebirthday Attack
Attackers can poison DNS caches in Unbound resolvers with ECS enabled, leading to data modification and security bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5994?
CVE-2025-5994 is a high-severity vulnerability in NLnet Labs Unbound, published on 16 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
Weakness: CWE-349
Which versions are affected by CVE-2025-5994?
Linux distribution packages (40)
python3-unbound AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
unbound AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
unbound-anchor AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
unbound-devel AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
unbound-dracut AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
unbound-libs AlmaLinux:10 | All versions | 1.20.0-12.el10_0 |
python3-unbound AlmaLinux:8 | All versions | 1.16.2-5.9.el8_10 |
unbound AlmaLinux:8 | All versions | 1.16.2-5.9.el8_10 |
unbound-devel AlmaLinux:8 | All versions | 1.16.2-5.9.el8_10 |
unbound-libs AlmaLinux:8 | All versions | 1.16.2-5.9.el8_10 |
python3-unbound AlmaLinux:9 | All versions | 1.16.2-19.el9_6.1 |
unbound AlmaLinux:9 | All versions | 1.16.2-19.el9_6.1 |
unbound-devel AlmaLinux:9 | All versions | 1.16.2-19.el9_6.1 |
unbound-dracut AlmaLinux:9 | All versions | 1.16.2-19.el9_6.1 |
unbound-libs AlmaLinux:9 | All versions | 1.16.2-19.el9_6.1 |
python3-unbound Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
python3-unbound-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-anchor Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-anchor-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-devel Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-dracut Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-libs Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-libs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
unbound-utils-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:1.20.0-12.el10_0 |
python3-unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
python3-unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
unbound-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.16.2-5.9.el8_10 |
python3-unbound Red Hat:enterprise_linux:9::appstream | All versions | 0:1.16.2-19.el9_6.1 |
python3-unbound-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.16.2-19.el9_6.1 |
unbound Red Hat:enterprise_linux:9::appstream | All versions | 0:1.16.2-19.el9_6.1 |
unbound-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.16.2-19.el9_6.1 |
unbound-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.16.2-19.el9_6.1 |
How do I fix CVE-2025-5994?
Apply the vendor's patch.
Is CVE-2025-5994 being exploited?
There is no known exploitation of CVE-2025-5994 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-5994, ALSA-2025:11849, ALSA-2025:11884, ALSA-2025:12064, CLEANSTART-2026-NH76134, CLSA-2025-1754649153 and 19 more.