The CVE number for this vulnerability is CVE-2026-109125.


== Description
An observable  cache-level side-channel can be exposed with
`unwanted-reply-threshold > 0` configurations (not a default configuration).

If a response-like UDP datagram reaches the upstream source port currently used
by a recursive query, but its TXID does not match any pending query, Unbound
counts the packet as an unwanted reply.
When the accumulated count reaches the configured threshold, Unbound
clears the worker's RRset cache and message cache.

This cache clear action does not destroy the current upstream UDP pending
query.
Therefore, an external observer can distinguish whether a candidate port
matches the current upstream source port by checking whether an existing cached
item has been cleared.
This is a cache side-channel vulnerability that can be used to probe the
upstream source port.

Although the attack is not feasible on default configurations and the suggested
value (10 million) makes it an ureliable attack on a public resolver, in
scenarios where the attacker can keep a concurrent query window alive, the
attacker can first filter the source port and then perform birthday-style
guessing against the TXID, making cache poisoning a feasible attack path.

Unbound 1.26.2 includes a fix that clears out the UDP queries waiting on the
port that was revealed in the side channel from the unwanted threshold action,
thus preventing the poison vulnerability.


== Affected products
Unbound up to and including version 1.26.1.


== Mitigation

=== Downloading patched version
Unbound 1.26.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.26.2.tar.gz

=== Applying the patch manually
For Unbound 1.26.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-109125.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-109125.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.26.1.


== Acknowledgments
We would like to thank TaoFei Guo from Peking University, and Yang Luo
and JianJun Chen from Tsinghua University for discovering and responsibly
disclosing the vulnerability.