Bug 2380949 (CVE-2025-5994)

Summary:	CVE-2025-5994 unbound: Unbound Cache poisoning
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A cache poisoning flaw has been discovered in unbound. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2381425, 2381426
Bug Blocks:

Description OSIDB Bzimport 2025-07-16 15:02:00 UTC

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.

Comment 2 errata-xmlrpc 2025-07-28 07:56:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:11849 https://access.redhat.com/errata/RHSA-2025:11849

Comment 3 errata-xmlrpc 2025-07-28 10:41:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11884 https://access.redhat.com/errata/RHSA-2025:11884

Comment 4 errata-xmlrpc 2025-07-29 09:29:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:12064 https://access.redhat.com/errata/RHSA-2025:12064

Comment 5 errata-xmlrpc 2025-07-31 14:18:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:12416 https://access.redhat.com/errata/RHSA-2025:12416

Comment 6 errata-xmlrpc 2025-08-04 01:18:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:12520 https://access.redhat.com/errata/RHSA-2025:12520

Comment 7 errata-xmlrpc 2025-08-04 01:48:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:12523 https://access.redhat.com/errata/RHSA-2025:12523

Comment 8 errata-xmlrpc 2025-08-05 08:14:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:12929 https://access.redhat.com/errata/RHSA-2025:12929

Comment 10 errata-xmlrpc 2025-08-11 07:33:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:13576 https://access.redhat.com/errata/RHSA-2025:13576

Comment 11 errata-xmlrpc 2025-08-11 07:35:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:13575 https://access.redhat.com/errata/RHSA-2025:13575

Comment 12 errata-xmlrpc 2025-08-11 07:44:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:13577 https://access.redhat.com/errata/RHSA-2025:13577

Comment 17 errata-xmlrpc 2025-10-21 14:49:27 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2025:15397 https://access.redhat.com/errata/RHSA-2025:15397

Comment 18 errata-xmlrpc 2025-10-22 05:08:13 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2025:18218 https://access.redhat.com/errata/RHSA-2025:18218

Comment 19 errata-xmlrpc 2025-10-22 06:19:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2025:18217 https://access.redhat.com/errata/RHSA-2025:18217

Comment 20 errata-xmlrpc 2025-10-23 17:44:40 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2025:18240 https://access.redhat.com/errata/RHSA-2025:18240

Comment 21 errata-xmlrpc 2025-10-29 09:25:21 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2025:19046 https://access.redhat.com/errata/RHSA-2025:19046

Comment 22 errata-xmlrpc 2025-10-30 05:40:39 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2025:19041 https://access.redhat.com/errata/RHSA-2025:19041

Comment 23 errata-xmlrpc 2025-11-13 09:44:48 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2025:19894 https://access.redhat.com/errata/RHSA-2025:19894