The CVE number for this vulnerability is CVE-2026-54478.


== Description
When Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie:
yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire
address instead of the PROXYv2-declared client.
One server cookie obtained through a given proxy node therefore validates for
every PROXYv2-declared source behind that node.
On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with
a single legitimate query, then replay it under any spoofed source and pass DNS
Cookie checks that were deployed to defeat this in the first place.

Unbound 1.25.2 includes a fix to always use the DNS client's IP for DNS server
cookie hash calculations.


== Affected products
Unbound 1.18.0 up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-54478.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-54478.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.