In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the… (CVE-2026-54478)

In NLnet Labs Unbound versions 1.18.0 up to and including 1.25.1, when configured to listen on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the server cookie as defined by RFC 9018 is incorrectly computed over the proxy's wire address instead of the PROXYv2-declared client address. This flaw means that a server cookie obtained through a given proxy node is valid for every client behind that proxy node. Consequently, on a UDP+proxy-protocol front, an off-path attacker can obtain one valid cookie with a legitimate query and then replay it using any spoofed source address, effectively bypassing DNS Cookie validation mechanisms designed to prevent such spoofing.

The vulnerability allows an off-path attacker to bypass DNS Cookie validation by replaying a valid server cookie for any spoofed source address behind a proxy node. This undermines the DNS Cookie mechanism's effectiveness in preventing DNS spoofing and cache poisoning attacks in environments using proxy-protocol ports with 'answer-cookie: yes'. The CVSS score is 3.7 (medium severity) reflecting limited impact with high attack complexity and no direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling 'answer-cookie: yes' on proxy-protocol-port interfaces or avoid using proxy-protocol ports with DNS Cookies enabled. Monitor vendor communications for official fixes.