A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0124 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-5994:
    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e262093d58 advisory.

    Update to 1.23.1 (rhbz#2380450)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12929 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1122 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12520 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12523 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2951 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2025-005 advisory.

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12416 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-12064 advisory.

    [1.20.0-12]
    - Fix CVE-2025-5994

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12064 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11884 advisory.

    - Fix RebirthDay Attack (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11884 advisory.

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11849 advisory.

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11849 advisory.

    - Fix RebirthDay Attack (CVE-2025-5994)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11849 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11884 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Unbound Cache poisoning (CVE-2025-5994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7666-1 advisory.

    Xiang Li discovered that Unbound incorrectly handled EDNS Client Subnet (ECS) in certain configurations. A     remote attacker could possibly use this issue to perform a cache poisoning attack called Rebirthday     Attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-350a4ec835 advisory.

    Update to 1.23.1 (rhbz#2380450)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e27ee4fc-cdc9-45a1-8242-09898cdbdc91 advisory.

    sep@nlnetlabs.nl reports:
    A multi-vendor cache poisoning vulnerability named 'Rebirthday             Attack' has been discovered in caching resolvers that support             EDNS Client Subnet (ECS).  Unbound is also vulnerable when compiled             with ECS support, i.e., '--enable-subnet', AND configured             to send ECS information along with queries to upstream name servers,             i.e., at least one of the 'send-client-subnet',             'client-subnet-zone' or 'client-subnet-always-forward'             options is used.  Resolvers supporting ECS need to segregate outgoing             queries to accommodate for different outgoing ECS information.  This             re-opens up resolvers to a birthday paradox attack (Rebirthday             Attack) that tries to match the DNS transaction ID in order to cache             non-ECS poisonous replies.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243988	Linux Distros Unpatched Vulnerability : CVE-2025-5994	Nessus	Misc.	high
243965	Alibaba Cloud Linux 3 : 0124: unbound (ALINUX3-SA-2025:0124)	Nessus	Alibaba Cloud Linux Local Security Checks	high
243931	Fedora 41 : unbound (2025-e262093d58)	Nessus	Fedora Local Security Checks	high
243564	RHEL 8 : unbound (RHSA-2025:12929)	Nessus	Red Hat Local Security Checks	high
243490	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2025-1122)	Nessus	Amazon Linux Local Security Checks	high
243447	RHEL 9 : unbound (RHSA-2025:12520)	Nessus	Red Hat Local Security Checks	high
243444	RHEL 9 : unbound (RHSA-2025:12523)	Nessus	Red Hat Local Security Checks	high
243440	Amazon Linux 2 : unbound (ALAS-2025-2951)	Nessus	Amazon Linux Local Security Checks	high
243422	Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2025-005)	Nessus	Amazon Linux Local Security Checks	high
243237	RHEL 9 : unbound (RHSA-2025:12416)	Nessus	Red Hat Local Security Checks	high
243040	Oracle Linux 10 : unbound (ELSA-2025-12064)	Nessus	Oracle Linux Local Security Checks	high
242960	RHEL 10 : unbound (RHSA-2025:12064)	Nessus	Red Hat Local Security Checks	high
242946	Oracle Linux 8 : unbound (ELSA-2025-11884)	Nessus	Oracle Linux Local Security Checks	high
242937	AlmaLinux 8 : unbound (ALSA-2025:11884)	Nessus	Alma Linux Local Security Checks	high
242936	AlmaLinux 9 : unbound (ALSA-2025:11849)	Nessus	Alma Linux Local Security Checks	high
242934	Oracle Linux 9 : unbound (ELSA-2025-11849)	Nessus	Oracle Linux Local Security Checks	high
242904	RHEL 9 : unbound (RHSA-2025:11849)	Nessus	Red Hat Local Security Checks	high
242890	RHEL 8 : unbound (RHSA-2025:11884)	Nessus	Red Hat Local Security Checks	high
242689	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : Unbound vulnerabilities (USN-7666-1)	Nessus	Ubuntu Local Security Checks	high
242410	Fedora 42 : unbound (2025-350a4ec835)	Nessus	Fedora Local Security Checks	high
242336	FreeBSD : unbound -- Cache poisoning via the ECS-enabled Rebirthday Attack (e27ee4fc-cdc9-45a1-8242-09898cdbdc91)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-5994

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high