NLnet Labs Unbound CVE-2026-54478

Exploitation requires two non-default Unbound configuration directives to be active simultaneously: proxy-protocol-port must designate at least one listening interface for PROXYv2-encapsulated connections, and answer-cookie: yes must be set to enable DNS Cookie processing. The transport must be UDP, as PROXYv2 header injection in this context occurs on a UDP+proxy-protocol front end. The attacker must be capable of sending at least one legitimate DNS query routed through the target proxy node in order to harvest a valid server cookie. What limits exploitation: the configuration is non-default and requires deliberate operator setup; TCP-only deployments behind the proxy are not affected; attackers without any ability to reach the resolver through the proxy node cannot harvest a cookie and cannot replay it.

The NVD CVSS score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) appropriately reflects the narrow attack surface: AC:H captures the non-default configuration prerequisite (both proxy-protocol-port and answer-cookie: yes must be active), and I:L reflects a security-control bypass rather than direct data manipulation or code execution. The vulnerability's real-world risk depends heavily on deployment topology - operators who have explicitly layered DNS Cookies atop PROXYv2 infrastructure to harden against spoofing are the only affected population, and for them the impact is the complete neutralization of that control. No EPSS data was supplied, so exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, suggesting it has not been operationalized at scale. The primary concern is that attackers aware of this flaw could defeat DNS Cookie-based amplification mitigations at affected resolvers, potentially re-enabling source-spoofed query floods. CVSS does not capture the second-order risk of undermining a deployed spoofing defense, which makes the practical severity somewhat higher than the raw score implies for affected deployments.

An attacker who can send a single DNS query through a PROXYv2 proxy node fronting a vulnerable Unbound instance issues a legitimate query and captures the server cookie returned - which is computed from the proxy node's IP, not the attacker's. The attacker then crafts subsequent UDP DNS queries with arbitrary spoofed source addresses, appending the harvested cookie; Unbound accepts these as cookie-validated, treating them as legitimate clients. Because DNS Cookies were the deployed control against off-path spoofed queries, this bypasses the primary anti-amplification and anti-spoofing defense at that resolver.