NLnet Labs Unbound CVE-2026-109125

Exploitation requires the resolver operator to have explicitly set 'unwanted-reply-threshold' to a value greater than 0 - this is NOT the default, so default Unbound deployments are not vulnerable. The attacker must be able to send response-like UDP datagrams to the upstream source port currently used by a pending recursive query and must keep a concurrent query window alive long enough to drive the unwanted-reply counter to the configured threshold and then observe the resulting cache clear. Realistic exploitation is further limited because the vendor-suggested threshold (10 million) makes the probe unreliable on busy/public resolvers, and the full cache-poisoning outcome additionally requires winning birthday-style TXID guessing before the query resolves. Practically feasible mainly against lower-traffic or specifically-tuned internal resolvers where the attacker can sustain the query window.

This is a genuinely low-to-moderate real-world risk despite the credible integrity impact, and the signals are internally consistent. CVSS 3.1 base score is 5.3 (Medium) with AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - no privileges or user interaction, but high attack complexity. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Critically, the vulnerability only exists under a non-default configuration ('unwanted-reply-threshold > 0'), and NLnet Labs explicitly notes the suggested threshold value (10 million) makes the attack unreliable against a public resolver. The AC:H rating is well justified because the attacker must maintain a concurrent query window and win a timing/probing race before the port rotates. The elevated I:H (and the real severity) comes not from the side channel itself but from its use as a stepping stone: leaking the upstream source port collapses the entropy a cache-poisoning attacker must guess, reducing the problem to birthday-style TXID guessing. One note of tension: the vendor rated this AV:A (adjacent), but off-path DNS cache-poisoning primitives are typically network-reachable (AV:N) - the practical blast radius may be slightly wider than AV:A implies, though AC:H and the non-default-config requirement remain the dominant limiting factors. Bottom line: not an emergency-patch item for default deployments, but operators who have deliberately enabled unwanted-reply-threshold should prioritize upgrading past 1.26.1.

An off-path attacker targets an Unbound resolver (≤1.26.1) that an operator has configured with 'unwanted-reply-threshold > 0'. The attacker floods candidate upstream source ports with response-like UDP datagrams carrying non-matching TXIDs, then observes (as a normal client) whether the worker's RRset/message cache has been cleared, revealing the true upstream source port; with the port known, they perform birthday-style TXID guessing to inject a poisoned record. No public exploit code is identified in the available data, and the attack requires keeping a concurrent query window alive, so it is complex and situational rather than turnkey.