CVE-2026-54478 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists in NLnet Labs Unbound DNS resolver versions 1.18.0 through 1.25.1 where the server-cookie implementation fails to properly handle proxy protocol addresses when answer-cookie is enabled. The flaw stems from incorrect SipHash computation that uses the proxy's physical wire address rather than the PROXYv2-declared client address as specified in RFC 9018. This represents a critical security weakness classified under CWE-284 Access Control and aligns with ATT&CK technique T1071.004 Application Layer Protocol for DNS traffic manipulation.
The technical implementation error occurs specifically when Unbound processes queries through proxy-protocol-port interfaces with answer-cookie enabled. When a client connects through a proxy server, the PROXYv2 protocol declares the original client address in the proxy header. However, the vulnerable code computes the server cookie using the actual network connection source rather than honoring the PROXYv2 client address declaration. This creates a scenario where a single server cookie generated for one client behind a proxy can be reused by any other client also behind that same proxy node.
The operational impact of this vulnerability is severe as it completely undermines the DNS cookie security mechanism designed to prevent cache poisoning attacks and query forgery. An off-path attacker can exploit this weakness by sending a single legitimate DNS query through a proxy server, harvesting the resulting server cookie, and then replaying that exact cookie value under any spoofed source address. This bypasses the intended protection mechanisms that were specifically deployed to defend against such attacks, effectively nullifying the DNS cookie validation process.
The vulnerability demonstrates a fundamental flaw in how Unbound handles address resolution when proxy protocol is involved, creating an authentication bypass scenario that allows attackers to impersonate legitimate clients. The security implications extend beyond simple query replay as this weakness can be leveraged for more sophisticated attacks including cache poisoning, traffic manipulation, and denial of service through forged queries. Organizations using Unbound with proxy-protocol-port configurations and answer-cookie enabled are particularly vulnerable to these attacks.
Mitigation strategies should focus on immediate version upgrades to Unbound 1.25.2 or later where this vulnerability has been patched. Administrators should also consider disabling answer-cookie functionality when proxy protocol is in use until the software can be properly updated, or implementing additional network-level controls such as source address validation and rate limiting. The fix addresses the core issue by ensuring that server cookies are computed using the PROXYv2-declared client address rather than the physical wire address, restoring proper authentication and preventing the cross-client cookie reuse described in this vulnerability.