Rebirthday Attack Vulnerability in Unbound DNS Resolver
Summary
CVE-2025-5994: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Affects unbound versions < 1.23.1-r0. Fixed in 1.23.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver that is widely used for its performance and security features. It supports EDNS Client Subnet (ECS), which allows DNS queries to include client subnet information to improve the accuracy of responses. However, when configured improperly, it becomes vulnerable to cache poisoning attacks, specifically the Rebirthday Attack, which exploits the way ECS information is handled.
Vulnerability Detail
A multi-vendor cache poisoning vulnerability, known as the 'Rebirthday Attack', has been identified in caching resolvers that support EDNS Client Subnet (ECS). Unbound is susceptible when compiled with ECS support and configured to send ECS information with queries to upstream name servers. This vulnerability allows attackers to exploit the birthday paradox to match DNS transaction IDs, enabling them to cache malicious replies that can compromise the integrity of DNS responses.
How To Fix
Minimum fixed version
1.23.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling ECS support in your Unbound configuration by removing or commenting out any lines that include 'send-client-subnet', 'client-subnet-zone', or 'client-subnet-always-forward'. This can be done by editing the Unbound configuration file, typically located at '/etc/unbound/unbound.conf'.
Conclusion
The Rebirthday Attack vulnerability in Unbound poses significant risks to DNS integrity when ECS is improperly configured. Users are advised to update their Unbound installations and review their configurations to mitigate potential attacks.
See every vulnerability recorded for unbound →
FAQ
The Rebirthday Attack is a cache poisoning technique that exploits the birthday paradox to match DNS transaction IDs, allowing attackers to inject malicious responses into the DNS cache.
Unbound is vulnerable when it is compiled with ECS support and configured to send ECS information, making it susceptible to cache poisoning attacks.
If exploited, this vulnerability can lead to the caching of malicious DNS responses, potentially redirecting users to harmful sites or intercepting sensitive information.
Yes, a patched version of Unbound is available. Users should update to the latest version to mitigate the risk associated with this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
