Unbound DNS CVE-2025-5994

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:04 vuln.today

DescriptionCVE.org

Alpine Linux: unbound fixed in 1.23.1-r0

AnalysisAI

Unbound DNS resolver on Alpine Linux received a security fix in package version 1.23.1-r0. The specific vulnerability class, attack vector, and impact have not been disclosed in the available intelligence - the CVE description provides only the fix packaging detail. EPSS at 0.24% (46th percentile) indicates low current exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Unbound is a widely deployed validating, recursive, and caching DNS resolver developed by NLnet Labs, commonly packaged in Alpine Linux for container and embedded use cases. Alpine Linux packages it under the 'unbound' apk. The fix was introduced in Alpine package version 1.23.1-r0. The upstream Unbound version corresponding to this Alpine package revision, the CWE root cause class, and the specific vulnerable code path are not disclosed in the available data. Without a CVE description, CVSS vector, or CWE, the underlying vulnerability mechanism - whether it involves DNS message parsing, resource exhaustion, memory safety, or another class - cannot be characterized from available intelligence.

Affected ProductsAI

Alpine Linux distributions running the unbound DNS resolver package prior to version 1.23.1-r0 are affected. The specific Alpine Linux release branches (e.g., edge, v3.x) carrying the vulnerable package version are not identified in the available data. No CPE strings were provided. The corresponding upstream NLnet Labs Unbound release version is not confirmed from available intelligence. Users should consult the Alpine Linux security tracker and the official Alpine advisory for package-level version mapping.

RemediationAI

Upgrade the unbound package on Alpine Linux to version 1.23.1-r0 or later using the standard apk package manager: 'apk upgrade unbound'. This is the vendor-confirmed fix per the Alpine Linux security report. No specific workarounds are documented in the available data. If immediate patching is not possible and the Unbound instance is internet-facing, consider restricting recursive query access to trusted clients only via access-control directives in unbound.conf, which limits exposure surface regardless of the specific vulnerability class. No additional advisory URLs were provided in the available intelligence; consult the Alpine Linux CVE tracker for the authoritative advisory.