Skip to content
OpenAdvisories
High USN-7666-1 1 CVE

unbound vulnerabilities

Published Jul 22, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Xiang Li discovered that Unbound incorrectly handled EDNS Client Subnet
(ECS) in certain configurations. A remote attacker could possibly use this
issue to perform a cache poisoning attack called Rebirthday Attack.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS unbound 1.13.1-1ubuntu5.11
Ubuntu · 24.04 LTS 24.04:LTS unbound 1.19.2-1ubuntu3.5

Vulnerabilities 1

  • High 8.7
    CVE-2025-5994

    Cache poisoning via the ECS-enabled Rebirthday Attack

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send E…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2025-5994