Executive brief
Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability in how it handles network traffic allows an attacker to predict the security codes used to verify DNS responses. This could allow a malicious actor to redirect users to fraudulent websites by poisoning the resolver's memory with incorrect data.
Technical details
Unbound (versions 1.4.22 through 1.25.1) is vulnerable to DNS cache poisoning when 'so-reuseport' is enabled (the default setting). The vulnerability stems from Unbound partitioning the UDP source port space into disjoint subsets assigned to specific worker threads. Because the kernel's SO_REUSEPORT mechanism deterministically assigns incoming queries to threads based on the source port/IP, an attacker can identify which thread is processing a query. This allows the attacker to predict the limited range of outgoing source ports used by that thread, significantly reducing the entropy of the DNS transaction and facilitating cache poisoning. The issue is resolved in version 1.25.2 by implementing a shared ports structure across threads.
Affected products
- NLnet Labs Unbound 1.4.22 up to and including 1.25.1
Timeline
- 2026-07-22: advisory: NLnet Labs released security advisory and version 1.25.2
- 2026-07-22: disclosed