CVE-2026-109125: NLnet Labs Unbound cache side-channel in upstream source port probe

CVE-2026-109125 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Unbound is a recursive DNS resolver used to translate domain names into IP addresses. A cache side-channel vulnerability allows an attacker to determine which source port Unbound uses when querying upstream DNS servers, potentially enabling DNS cache poisoning attacks. This vulnerability only affects non-default configurations and requires the attacker to maintain concurrent query windows, making practical exploitation limited but feasible in specific scenarios.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-109125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109125 being exploited in the wild.
How severe is CVE-2026-109125?
Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?
NLnet Labs Unbound up to and including 1.26.1.
Is there a fix for CVE-2026-109125?
Yes: fixed in Unbound 1.26.2. Until then: Upgrade to Unbound 1.26.2 or apply the manual patch from https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-109125.diff to Unbound 1.26.1 and rebuild. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109125 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109125?
Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Unbound 1.26.2

Upgrade to Unbound 1.26.2 or apply the manual patch from https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-109125.diff to Unbound 1.26.1 and rebuild.

Technical details

When 'unwanted-reply-threshold' is configured above zero (non-default), Unbound clears its RRset and message caches upon reaching the unwanted reply count, but does not purge pending UDP queries on the exposed port. An external observer can detect cache clears by querying cached items, revealing the current upstream source port and enabling birthday-style TXID guessing attacks. The vulnerability requires network-level observation and maintenance of concurrent queries to be practically exploitable for cache poisoning.

Affected products

  • NLnet Labs Unbound up to and including 1.26.1

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.