EUVD-2026-47678
GHSA-pp7x-83x2-99v7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network vector because DNS queries arrive remotely; AC:H because simultaneous proxy-protocol-port and answer-cookie configuration is required; I:L captures security-control bypass with no confidentiality or availability impact.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
AnalysisAI
DNS Cookie bypass in NLnet Labs Unbound 1.18.0 through 1.25.1 allows an off-path network attacker to defeat RFC 7873 DNS Cookie spoofing protections when Unbound is simultaneously configured with proxy-protocol-port and answer-cookie: yes. The RFC 9018 server-cookie SipHash is computed over the proxy node's wire-layer IP address rather than the PROXYv2-declared client address, meaning a single valid cookie harvested through any proxy node is reusable against every spoofed source behind that node. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the conceptual attack path is straightforward for any attacker with the ability to send one legitimate DNS query through the affected proxy infrastructure.
Technical ContextAI
Unbound is a validating, recursive DNS resolver developed by NLnet Labs. RFC 7873 defines DNS Cookies as a lightweight mechanism to protect against off-path (source-spoofed) DNS attacks, including reflection/amplification and cache poisoning. RFC 9018 specifies SipHash-2-4 as the algorithm for computing server-side DNS cookies, with the client's IP address as a key input to bind the cookie to a specific source. PROXYv2 is a binary header protocol allowing load balancers and proxy nodes to forward the original client's IP to backend servers. Unbound's proxy-protocol-port directive enables listening on a port that expects PROXYv2 headers. The root cause (CWE-290, Authentication Bypass by Spoofing) is that when both features are active simultaneously, the SipHash computation consumes the proxy node's actual wire-layer source address rather than the client IP declared in the PROXYv2 header. This collapses the per-client cookie binding to a per-proxy binding, invalidating the spoofing-resistance guarantee. The affected CPE is cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* spanning versions 1.18.0 to 1.25.1.
RemediationAI
Consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt for the specific patched release version, and upgrade as soon as it is available; the advisory is the authoritative source since no explicit fix version appears in the current data. As an immediate workaround, operators can disable DNS Cookies on proxy-protocol-port interfaces by setting answer-cookie: no for those listeners, accepting the trade-off that DNS Cookie spoofing protection will no longer apply to queries arriving via that proxy path. Alternatively, operators can remove proxy-protocol-port configuration and use a network-level mechanism to pass client addresses, though this may affect logging fidelity or load-balancer integration. If neither workaround is acceptable, rate-limiting DNS query volume from known proxy nodes and deploying upstream filtering against spoofed sources (BCP38) can reduce the amplification risk that DNS Cookies were intended to address.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today