Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109125— Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

Quick assessment

Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 NLnet Labs 的 Unbound 软件中，版本 1.26.1 及更早版本存在一个可观测的缓存级侧信道漏洞。当配置中启用了 （该配置并非默认启用）时，此漏洞可被触发。若一个类似响应的 UDP 数据报到达当前递归查询所使用的上游源端口，但其事务 ID（TXID）与任何待处理查询均不匹配，Unbound 会将该数据包计为“不需要的回复”。当累计计数达到配置的阈值时，Unbound 会清除工作线程的 RRset 缓存和消息缓存。然而，该缓存清除操作并不会销毁当前待处理的上游 UDP 查询。因此，外部攻击者可以通

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109125

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过行为差异性导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Unbound 0 ~ 1.26.2 -

II. Public POCs for CVE-2026-109125

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109125

请登录查看更多情报信息。

Other References for CVE-2026-109125 (1)

Same Patch Batch · NLnet Labs · 2026-10-21 · 5 CVEs total

CVE-2026-97206 7.5 HIGH DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployment
CVE-2026-50106 6.5 MEDIUM Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor
CVE-2026-96405 5.3 MEDIUM Aggregate DNS name chained pointer decompression work leads to degradation of service.
CVE-2026-35501 3.7 LOW Bypass of a configured island trust anchor underneath an insecure parent from an atacker-c

IV. Related Vulnerabilities

Same product: Unbound
Same vendor: NLnet Labs
Same weakness: CWE-205

V. Comments for CVE-2026-109125

No comments yet

Leave a comment