CVE-2025-5994VulnerabilityPublished 16 Jul 2025Updated 3 Nov 2025

CVE-2025-5994: NLnet Labs Unbound · Acceptance of Extraneous Untrusted Data With Trusted Data

Affects NLnet Labs UnboundSource CVE Database V5

Not known to be exploited · CVSS 8.7 High.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 4.0 base score

8.7High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C

Base metrics

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: High
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Supplemental metrics

Recovery: User
Value Density: Concentrated

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
Recovery: User: The system requires manual intervention by the user to recover services, after an attack has been performed.
Value Density: Concentrated: The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users. An example of Concentrated (think: broad) Value Density would be an attack on a central email server.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
NLnet Labs Unbound	Affected =1.6.2	Fixed in–

AI-suggested

European organizations should immediately audit their Unbound deployments to identify if ECS support is enabled and configured to send ECS data upstream. If ECS is not essential, disabling ECS support by recompiling Unbound without the '--enable-subnet' option or disabling ECS forwarding options ('send-client-subnet', 'client-subnet-zone', 'client-subnet-always-forward') can mitigate the risk. For environments requiring ECS, organizations should monitor NLnet Labs advisories for patches addressing this vulnerability and apply updates promptly once available. In the interim, implementing DNSSEC validation can help detect and reject forged DNS responses, reducing the impact of cache poisoning. Network-level protections such as rate limiting DNS responses, deploying DNS over TLS (DoT) or DNS over HTTPS (DoH) to secure DNS traffic, and monitoring DNS query patterns for anomalies can further reduce attack surface. Additionally, segregating ECS queries by subnet more robustly, if configurable, may mitigate the birthday paradox exploitation. Organizations should also consider deploying alternative resolvers with proven mitigations against ECS-related cache poisoning until patches are released.

Description

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

Impact

For European organizations, this vulnerability threatens the integrity and availability of DNS resolution services, which are foundational to network operations and security. Successful exploitation can lead to DNS cache poisoning, redirecting users to malicious websites, enabling phishing, malware distribution, or interception of sensitive communications. This can compromise confidentiality by facilitating man-in-the-middle attacks and degrade service availability through DNS disruption. Organizations relying on Unbound with ECS enabled—common in ISPs, enterprises, and public DNS services—may experience widespread impact. Given the critical role of DNS in internet connectivity, exploitation could affect critical infrastructure, financial institutions, government agencies, and other sectors dependent on reliable DNS. The lack of authentication and user interaction requirements increases the risk of remote exploitation. Additionally, the multi-vendor nature of the Rebirthday Attack suggests that other ECS-supporting resolvers may also be vulnerable, amplifying the threat landscape in Europe.

Summary

CVE-2025-5994 identifies a critical vulnerability in NLnet Labs' Unbound DNS resolver version 1.6.2 when compiled with ECS support ('--enable-subnet') and configured to send ECS information upstream (via 'send-client-subnet', 'client-subnet-zone', or 'client-subnet-always-forward'). The vulnerability arises due to improper segregation of outgoing DNS queries based on ECS data, which reintroduces susceptibility to a birthday paradox-based cache poisoning attack dubbed the Rebirthday Attack. In this attack, an adversary exploits the limited entropy of DNS transaction IDs and the reuse of query parameters to inject malicious DNS responses into the resolver's cache. By matching transaction IDs, attackers can poison the cache with non-ECS malicious replies, effectively redirecting users or disrupting DNS resolution. The vulnerability is classified under CWE-349, indicating acceptance of extraneous untrusted data alongside trusted data, which undermines the integrity of DNS responses. The CVSS 4.0 score of 8.7 reflects the network attack vector, no required privileges or user interaction, and a high impact on integrity and availability. Although no public exploits are reported yet, the vulnerability affects any deployment of Unbound 1.6.2 with ECS enabled and configured to forward ECS data, making it a significant threat to DNS infrastructure relying on ECS for client subnet privacy or routing optimization.

CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data (opens in a new tab)
Base weakness
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
Cache Poisoning (opens in a new tab)
DNS Cache Poisoning (opens in a new tab)
Manipulating Writeable Configuration Files (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2025, 20:37 UTC

WeaknessesCWE-349

Technical details

References

Community reviews

Related threats