A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

debian_linux dsa-5987: Debian dsa-5987 : libunbound-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4280 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4280-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     August 24, 2025                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : unbound     Version        : 1.13.1-1+deb11u5     CVE ID         : CVE-2024-33655 CVE-2025-5994     Debian Bug     : 1109427

    Vulnerabilities were found in unbound, a validating, recursive, and     caching DNS resolver, which may lead to Denial of Service or cache     poisoning.

    CVE-2024-33655

        The DNSBomb attack, via specially timed DNS queries and answers, can         cause a Denial of Service on resolvers and spoofed targets.

        While Unbound itself is not vulnerable for DoS, it can be used to         take part in a pulsing DoS amplification attack.

        Configuration options have been added to help mitigate the impact by         trying to shrink the DNSBomb window so that the impact of the DoS         from Unbound is significantly lower than it used to be:

          * discard-timeout: 1900             After 1900 ms a reply to the client will be dropped.  Unbound             would still work on the query but refrain from replying in order             to not accumulate a huge number of old replies.  Legitimate             clients retry on timeouts.

          * wait-limit: 1000             Limits the amount of client queries that require recursion             (cache-hits are not counted) per IP address.  More recursive             queries than the allowed limit are dropped.
            wait-limit: 0 disables all wait limits.

          * wait-limit-netblock             These do not have a default value but they can fine grain             configuration for specific netblocks.

    CVE-2025-5994

        Resolvers supporting ECS need to segregate outgoing queries to         accommodate for different outgoing ECS information.  This re-opens         up resolvers to a birthday paradox attack (Rebirthday Attack) that         tries to match the DNS transaction ID in order to cache non-ECS         poisonous replies.

        Unbound now includes a fix that disregards replies that came back         without ECS when ECS was expected.

    This update also includes follow-up upstream fixes and improvements for     CVE-2024-43167 and CVE-2024-43168.

    For Debian 11 bullseye, these problems have been fixed in version     1.13.1-1+deb11u5.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13576 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13575 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13577 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0124 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-5994:
    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e262093d58 advisory.

    Update to 1.23.1 (rhbz#2380450)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12929 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1122 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12520 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12523 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2951 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2025-005 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12416 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-12064 advisory.

    [1.20.0-12]
    - Fix CVE-2025-5994

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12064 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11884 advisory.

    - Fix RebirthDay Attack (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11884 advisory.

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11849 advisory.

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11849 advisory.

    - Fix RebirthDay Attack (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11849 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11884 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7666-1 advisory.

    Xiang Li discovered that Unbound incorrectly handled EDNS Client Subnet (ECS) in certain configurations. A     remote attacker could possibly use this issue to perform a cache poisoning attack called Rebirthday     Attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-350a4ec835 advisory.

    Update to 1.23.1 (rhbz#2380450)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e27ee4fc-cdc9-45a1-8242-09898cdbdc91 advisory.

    sep@nlnetlabs.nl reports:
    A multi-vendor cache poisoning vulnerability named 'Rebirthday             Attack' has been discovered in caching resolvers that support             EDNS Client Subnet (ECS).  Unbound is also vulnerable when compiled             with ECS support, i.e., '--enable-subnet', AND configured             to send ECS information along with queries to upstream name servers,             i.e., at least one of the 'send-client-subnet',             'client-subnet-zone' or 'client-subnet-always-forward'             options is used.  Resolvers supporting ECS need to segregate outgoing             queries to accommodate for different outgoing ECS information.  This             re-opens up resolvers to a birthday paradox attack (Rebirthday             Attack) that tries to match the DNS transaction ID in order to cache             non-ECS poisonous replies.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
254407	Debian dla-4280 : libunbound-dev - security update	Nessus	Debian Local Security Checks	high
247833	RHEL 8 : unbound (RHSA-2025:13576)	Nessus	Red Hat Local Security Checks	high
247831	RHEL 8 : unbound (RHSA-2025:13575)	Nessus	Red Hat Local Security Checks	high
247829	RHEL 8 : unbound (RHSA-2025:13577)	Nessus	Red Hat Local Security Checks	high
243988	Linux Distros Unpatched Vulnerability : CVE-2025-5994	Nessus	Misc.	high
243965	Alibaba Cloud Linux 3 : 0124: unbound (ALINUX3-SA-2025:0124)	Nessus	Alibaba Cloud Linux Local Security Checks	high
243931	Fedora 41 : unbound (2025-e262093d58)	Nessus	Fedora Local Security Checks	high
243564	RHEL 8 : unbound (RHSA-2025:12929)	Nessus	Red Hat Local Security Checks	high
243490	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2025-1122)	Nessus	Amazon Linux Local Security Checks	high
243447	RHEL 9 : unbound (RHSA-2025:12520)	Nessus	Red Hat Local Security Checks	high
243444	RHEL 9 : unbound (RHSA-2025:12523)	Nessus	Red Hat Local Security Checks	high
243440	Amazon Linux 2 : unbound (ALAS-2025-2951)	Nessus	Amazon Linux Local Security Checks	high
243422	Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2025-005)	Nessus	Amazon Linux Local Security Checks	high
243237	RHEL 9 : unbound (RHSA-2025:12416)	Nessus	Red Hat Local Security Checks	high
243040	Oracle Linux 10 : unbound (ELSA-2025-12064)	Nessus	Oracle Linux Local Security Checks	high
242960	RHEL 10 : unbound (RHSA-2025:12064)	Nessus	Red Hat Local Security Checks	high
242946	Oracle Linux 8 : unbound (ELSA-2025-11884)	Nessus	Oracle Linux Local Security Checks	high
242937	AlmaLinux 8 : unbound (ALSA-2025:11884)	Nessus	Alma Linux Local Security Checks	high
242936	AlmaLinux 9 : unbound (ALSA-2025:11849)	Nessus	Alma Linux Local Security Checks	high
242934	Oracle Linux 9 : unbound (ELSA-2025-11849)	Nessus	Oracle Linux Local Security Checks	high
242904	RHEL 9 : unbound (RHSA-2025:11849)	Nessus	Red Hat Local Security Checks	high
242890	RHEL 8 : unbound (RHSA-2025:11884)	Nessus	Red Hat Local Security Checks	high
242689	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : Unbound vulnerabilities (USN-7666-1)	Nessus	Ubuntu Local Security Checks	high
242410	Fedora 42 : unbound (2025-350a4ec835)	Nessus	Fedora Local Security Checks	high
242336	FreeBSD : unbound -- Cache poisoning via the ECS-enabled Rebirthday Attack (e27ee4fc-cdc9-45a1-8242-09898cdbdc91)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-5994

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high