CVE-2026-109125: CWE-205: Observable Behavioral Discrepancy in NLnet Labs Unbound

NLnet Labs Unbound versions prior to 1.26.2, when configured with 'unwanted-reply-threshold' greater than zero, are vulnerable to a cache-level side-channel attack. The mechanism counts UDP datagrams that resemble responses but have TXIDs not matching any pending queries as unwanted replies. Upon reaching the threshold, Unbound clears its RRset and message caches without affecting the current upstream UDP query. This behavior allows an external observer to detect if a candidate port matches the upstream source port by checking cache clearing events. While the attack is not feasible on default settings and is unreliable with suggested high threshold values, it can be leveraged in scenarios with concurrent query windows to filter source ports and perform birthday-style TXID guessing, potentially enabling cache poisoning.

The vulnerability allows an attacker to infer the upstream source port used by Unbound recursive queries through a cache side-channel, which can be leveraged to facilitate cache poisoning attacks. There is no direct confidentiality or availability impact reported. The attack complexity is high and requires specific non-default configurations, limiting its practical exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires non-default 'unwanted-reply-threshold' configurations, avoiding or disabling this setting mitigates the risk. Monitoring for vendor updates or patches addressing this issue is recommended.