Cache-Level Side-Channel Vulnerability in NLnet Labs Unbound

CVE-2026-109125

What is CVE-2026-109125?

In NLnet Labs Unbound versions up to 1.26.1, a cache-level side-channel vulnerability can be exploited through specific configurations not set by default. When the 'unwanted-reply-threshold' is greater than zero, incoming UDP datagrams that do not match any active transactions can trigger a cache clear when a certain threshold is met. This leads to the potential exposure of the upstream source port by allowing an external observer to monitor cache clears and deduce whether the candidate port aligns with the upstream source. Even though the default settings mitigate the attack surface, determined attackers who maintain concurrent queries may exploit this vulnerability to facilitate cache poisoning attacks by filtering source ports and guessing transaction IDs.

References