The CVE number for this vulnerability is CVE-2025-5994.

A multi-vendor cache poisoning vulnerability named "Rebirthday Attack"
has been discovered in caching resolvers that support EDNS Client Subnet
(ECS).
Unbound is also vulnerable when compiled with ECS support, i.e.,
'--enable-subnet', AND configured to send ECS information along with
queries to upstream name servers.


== Summary
Resolvers supporting ECS need to segregate outgoing queries to
accommodate for different outgoing ECS information.
This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack)
that tries to match the DNS transaction ID in order to cache non-ECS poisonous
replies.

Unbound 1.23.1 includes a fix to mitigate the Rebirthday Attack.


== Affected products
Unbound 1.6.2 up to and including version 1.23.0 compiled with ECS support.


== Description
A vulnerable Unbound installation is one compiled with '--enable-subnet'
and configured to send ECS information to upstream name servers with at
least one of the 'send-client-subnet', 'client-subnet-zone' or
'client-subnet-always-forward' options.

A malicious actor can then exploit the Rebirthday Attack in two steps.
First, send queries to Unbound that would result in segregated ECS
outbound traffic from Unbound for a single domain.
Second, send non-ECS poisonous replies to Unbound trying to guess the
DNS transaction ID before the real answer from the upstream name server
arrives.

Unbound version 1.23.1 includes a fix that disregards replies that came
back without ECS when ECS was expected.
Instead it creates a non-ECS sub query, that could be aggregated with other
such queries, to explicitly query for the non-ECS authoritative answer.
The re-introduced query aggregation then defeats the Rebirthday Attack.


== Mitigation

=== Downloading patched version
Unbound 1.23.1 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.23.1.tar.gz

=== Applying the patch manually
For Unbound 1.23.0 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-5994_2.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2025-5994_2.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.23.0.


== Acknowledgments
We would like to thank Xiang Li (AOSP Lab, Nankai University) for
discovering and responsibly disclosing the vulnerability.