CVE-2026-109125: NLnet Labs Unbound Cache Side-Channel

CVE-2026-109125 Overview

NLnet Labs Unbound through version 1.26.1 contains an observable cache-level side-channel vulnerability. The flaw affects deployments configured with unwanted-reply-threshold > 0, which is not the default setting. An attacker on an adjacent network can probe the upstream UDP source port of an in-flight recursive query by observing cache state changes. Successful source port identification reduces the entropy required for DNS cache poisoning, allowing an attacker to then perform birthday-style guessing against the transaction ID (TXID). The vulnerability is tracked under CWE-205: Observable Behavioral Discrepancy.

Critical Impact
When unwanted-reply-threshold is enabled, an attacker who maintains a concurrent query window can filter the upstream source port and chain the leak into feasible DNS cache poisoning.

Affected Products

NLnet Labs Unbound versions up to and including 1.26.1
Deployments configured with unwanted-reply-threshold > 0
Recursive resolver installations exposed to adjacent network observers

Discovery Timeline

2026-10-21 - CVE-2026-109125 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-109125

Vulnerability Analysis

Unbound tracks response-like UDP datagrams that arrive on an upstream source port currently used by a pending recursive query but carry a TXID that does not match any outstanding request. These datagrams are counted as unwanted replies. When the accumulated count reaches the configured unwanted-reply-threshold, Unbound clears the worker's RRset cache and message cache as a defensive measure. The cache clear does not cancel the in-flight upstream UDP query. An external observer can therefore distinguish whether a candidate port matches the active upstream source port by sending crafted datagrams and checking whether a known cached record was evicted.

The vulnerability converts a defensive counter into an oracle. An attacker who can issue queries and observe cached entries learns which candidate UDP source port is live. Although the suggested threshold value of 10 million makes the attack unreliable against a busy public resolver, an attacker who can keep a concurrent query window open narrows the port search space before performing TXID guessing.

Root Cause

The root cause is an observable side effect in the unwanted-reply handling logic. The cache-clear action produces a globally visible state transition that correlates with a per-query internal secret, the upstream source port. The handling does not account for an attacker's ability to measure cache state through subsequent queries.

Attack Vector

Exploitation requires adjacent network positioning and a non-default configuration with unwanted-reply-threshold enabled. The attacker floods the resolver with response-like UDP packets across candidate source ports until the threshold is reached. By querying for a previously cached record and detecting its removal, the attacker confirms the correct source port. The attacker then performs TXID guessing within the identified port, enabling cache poisoning. No code example is provided; refer to the NLnet Labs CVE-2026-109125 Advisory for additional technical detail.

Detection Methods for CVE-2026-109125

Indicators of Compromise

Sustained high-volume UDP traffic directed at the resolver's upstream-facing ephemeral port range from a single or small set of adjacent sources.
Repeated clearing of the worker RRset and message caches logged by Unbound without a corresponding operational trigger.
Elevated num.query.cachemiss or equivalent statistics for domains that were recently cached.

Detection Strategies

Monitor Unbound log entries that reference the unwanted-reply-threshold being reached and correlate frequency against baseline.
Inspect unbound-control stats_noreset output for abnormal num.query.unwanted.reply counters.
Deploy network sensors to flag high rates of inbound UDP datagrams on upstream resolver source ports from adjacent network segments.

Monitoring Recommendations

Alert on any configuration drift that sets unwanted-reply-threshold to a non-zero value on recursive resolvers.
Correlate DNS cache miss spikes with contemporaneous unwanted-reply counter increases.
Record and review resolver answer anomalies, including unexpected authoritative data for monitored zones.

How to Mitigate CVE-2026-109125

Immediate Actions Required

Audit all Unbound deployments for the presence of unwanted-reply-threshold and set the value to 0 unless operationally required.
Upgrade Unbound to the fixed release referenced in the NLnet Labs CVE-2026-109125 Advisory once available in your distribution.
Restrict adjacent network access to recursive resolvers through segmentation and firewall rules.

Patch Information

NLnet Labs has published advisory details at the NLnet Labs CVE-2026-109125 Advisory. Apply the vendor-supplied fix for versions after 1.26.1 as soon as it is distributed through your package channel.

Workarounds

Set unwanted-reply-threshold: 0 in unbound.conf to disable the vulnerable counter-based cache clearing behavior.
Enforce DNSSEC validation on the resolver to prevent cache poisoning from succeeding even if the source port is inferred.
Limit which clients can query the resolver through access-control directives, reducing exposure to adjacent network observers.

bash

# Configuration example: disable the vulnerable threshold in unbound.conf
server:
    unwanted-reply-threshold: 0
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    harden-dnssec-stripped: yes
    val-permissive-mode: no