CVE-2026-109125: 
Unbound vulnerability analysis and mitigation

CVE-2026-109125 is a cache-level side-channel vulnerability in NLnet Labs Unbound DNS resolver that enables upstream source port probing and facilitates DNS cache poisoning. It affects all versions of Unbound up to and including 1.26.1, and is only exploitable when the non-default unwanted-reply-threshold > 0 configuration is active. The vulnerability was published on October 21, 2026, with a patch available in version 1.26.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, NLnet Labs Advisory).

The root cause is classified as CWE-205 (Observable Behavioral Discrepancy): when a response-like UDP datagram arrives at the upstream source port used by a recursive query but carries a non-matching TXID, Unbound increments an unwanted-reply counter. Once this counter reaches the configured unwanted-reply-threshold, Unbound clears the worker's RRset cache and message cache — but crucially does not terminate the pending upstream UDP query. An adjacent-network attacker can exploit this observable behavior by sending crafted UDP datagrams to candidate source ports and monitoring whether cached DNS entries are evicted; a cache flush confirms the probed port matches the active upstream source port. With the source port identified, the attacker can then perform birthday-style TXID guessing (65,536 possible values) to inject a forged DNS response, making cache poisoning feasible (GitHub Advisory, NLnet Labs Advisory).

Successful exploitation allows an unauthenticated attacker on an adjacent network to poison the Unbound resolver's DNS cache with malicious responses, redirecting users to attacker-controlled infrastructure. This primarily affects integrity (forged DNS records) with no direct confidentiality or availability impact. The practical consequence includes potential phishing, credential theft, or man-in-the-middle attacks against clients relying on the poisoned resolver. The attack is constrained to non-default configurations and adjacent-network positioning, limiting its scope compared to fully remote vulnerabilities (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting very low current exploitation probability. The attack requires adjacent network access, a non-default configuration (unwanted-reply-threshold > 0), and the ability to maintain a concurrent query window — conditions that significantly limit the attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Unbound resolver instances on the adjacent network and confirm they are configured with unwanted-reply-threshold > 0 (e.g., by observing cache-flush behavior or reviewing exposed configuration).
2. Establish baseline cache state: Issue a DNS query through the target resolver to populate a known cache entry (e.g., resolve a controlled domain), then verify the entry is cached by querying again and observing a fast response.
3. Port probing via cache side-channel: Send crafted UDP datagrams with arbitrary TXIDs to candidate upstream source ports (1–65535) on the resolver's upstream interface. After sending enough packets to approach the unwanted-reply-threshold, query the resolver for the previously cached entry. If the cache has been cleared (cache miss), the probed port matches the active upstream source port.
4. Narrow source port: Repeat step 3 iteratively across port ranges to identify the exact upstream source port currently in use for a pending recursive query.
5. TXID guessing (birthday attack): With the source port confirmed, send forged DNS response UDP packets to the resolver's upstream source port with varying TXIDs (0–65535), spoofing the upstream authoritative server's IP. Maintain a concurrent query window to keep the pending query alive long enough for a TXID match.
6. Cache poisoning: Upon a TXID match, the forged response is accepted by Unbound and cached, redirecting subsequent client queries for the target domain to an attacker-controlled IP (GitHub Advisory, NLnet Labs Advisory).

• Network: High volumes of UDP packets sent to the resolver's upstream source ports from an adjacent host, particularly packets with mismatched or random TXIDs targeting the resolver's outbound query ports.
• Network: Unusual DNS responses arriving from unexpected source IPs claiming to be authoritative servers.
• Logs: Repeated log entries in Unbound logs indicating unwanted reply counts incrementing rapidly (e.g., unbound[...]: unwanted reply from ...), especially approaching the configured threshold.
• Logs: Frequent cache flush events in Unbound logs (unbound[...]: cache cleared) not correlated with normal operational patterns or restarts.
• DNS: Unexpected changes in resolved IP addresses for known domains served from the resolver's cache, potentially indicating successful cache poisoning.

Upgrade NLnet Labs Unbound to version 1.26.2 or later, which addresses this vulnerability (NLnet Labs Advisory). If immediate patching is not possible, disable the unwanted-reply-threshold setting (the default is effectively disabled/infinite, which prevents exploitation) or set it to 0 in unbound.conf. Administrators should audit all Unbound deployments for non-default unwanted-reply-threshold values and remove them unless operationally required. Additionally, enabling DNSSEC validation on the resolver provides a defense-in-depth measure against cache poisoning attacks.