CVE-2026-109125: Unbound Vulnerability (CVSS 5.3)

Description

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.17%

6.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-205

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
NLnet Labs	Unbound	< 1.26.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt

Timeline

Published: Oct 21, 2026
Last Modified: Oct 29, 2026
Status: Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-109125?

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.

How severe is CVE-2026-109125?

CVE-2026-109125 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.

How do I fix CVE-2026-109125?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →