A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade unbound-dracutUpgrade python3-unboundUpgrade unbound-libsUpgrade unboundUpgrade unbound-devel | Jul 29, 2025 | Jul 28, 2025 |
| Alpine Linux | — | Upgrade unbound | Aug 8, 2025 | Jul 16, 2025 |
| Amazon Linux Ami 2 | — | Upgrade unbound-anchorUpgrade unbound-develUpgrade unboundUpgrade python2-unboundUpgrade unbound-libsUpgrade unbound-utilsUpgrade unbound-debuginfoUpgrade python3-unbound | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade unbound-debugsourceUpgrade unbound-libs-debuginfoUpgrade unbound-utils-debuginfoUpgrade unbound-anchor-debuginfoUpgrade python3-unbound-debuginfoUpgrade unbound-libsUpgrade unbound-develUpgrade python3-unboundUpgrade unboundUpgrade unbound-anchorUpgrade unbound-utilsUpgrade unbound-debuginfo | Aug 5, 2025 | Jul 16, 2025 |
| Debian | — | Upgrade unbound | Jul 18, 2025 | Jul 16, 2025 |
| Freebsd | — | Upgrade unbound | Jul 19, 2025 | Jul 18, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade unbound-libsUpgrade python3-unboundUpgrade unbound | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-unboundUpgrade unboundUpgrade unbound-libs | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade unbound-libsUpgrade unboundUpgrade python3-unbound | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade unbound-libsUpgrade python3-unbound | Oct 24, 2025 | Oct 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade unbound-dracutUpgrade python3-unboundUpgrade unbound-anchorUpgrade unbound-libsUpgrade unboundUpgrade unbound-devel | Jul 29, 2025 | Jul 16, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 16, 2025 |
| Redhat_linux | — | Upgrade unbound-develUpgrade unbound-dracutUpgrade python3-unbound-debuginfoUpgrade unbound-debugsourceUpgrade unbound-libsUpgrade unbound-anchor-debuginfoUpgrade unbound-debuginfoUpgrade unboundNo solution existsUpgrade unbound-libs-debuginfoUpgrade unbound-utils-debuginfoUpgrade unbound-anchorUpgrade python3-unbound | Jul 17, 2025 | Jul 16, 2025 |
| Rocky_linux | — | Upgrade unbound-debuginfoUpgrade python3-unbound-debuginfoUpgrade unbound-anchor-debuginfoUpgrade unbound-dracutUpgrade unboundUpgrade unbound-libs-debuginfoUpgrade unbound-libsUpgrade unbound-anchorUpgrade unbound-debugsourceUpgrade unbound-develUpgrade python3-unbound | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade unboundUpgrade unbound-anchorUpgrade libunbound8Upgrade unbound-develUpgrade python3-unbound | Nov 5, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade unboundUpgrade libunbound8 | Jul 23, 2025 | Jul 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Jul 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub