Observable discrepancy in Unbound - CVE-2026-109125
Published: October 21, 2026
Vulnerability details
The vulnerability allows a remote attacker to discover the upstream UDP source port used by a recursive query and potentially poison the DNS cache.
The vulnerability exists due to an observable cache-state discrepancy in Unbound's unwanted-reply handling when reaching the configured threshold clears cached records but leaves pending upstream UDP queries active. A remote attacker can send response-like UDP datagrams with nonmatching transaction IDs to candidate ports and check whether cached items disappear to identify the active source port, then attempt birthday-style transaction ID guessing to poison the cache if a concurrent query window can be kept alive.
Exposure requires the nondefault configuration unwanted-reply-threshold > 0.