Unbound 1.23.1 released

We are pleased to announce the release of version 1.23.1 of the Unbound recursive DNS resolver.

This security release fixes CVE-2025-5994.

A multi-vendor cache poisoning vulnerability named "Rebirthday Attack" has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., --enable-subnet, AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the send-client-subnet, client-subnet-zone or client-subnet-always-forward options is used.

A malicious actor can then exploit the Rebirthday Attack in two steps. First, send queries to Unbound that would result in segregated ECS outbound traffic from Unbound for a single domain. Second, send non-ECS poisonous replies to Unbound trying to guess the DNS transaction ID before the real answer from the upstream name server arrives.

Unbound version 1.23.1 includes a fix that disregards replies that came back without ECS when ECS was expected. Instead it creates a non-ECS sub query, that could be aggregated with other such queries, to explicitly query for the non-ECS authoritative answer. The re-introduced query aggregation then defeats the Rebirthday Attack.

We would like to thank Xiang Li (AOSP Lab, Nankai University) for discovering and responsibly disclosing the vulnerability.

For a full list of changes, binary and source packages, see the download page.