CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol use
DNS Cookie bypass when combined with proxy-protocol use
Other sources
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.25.2-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54478?
The severity of CVE-2026-54478 is classified as low with a score of 3.7.
How does CVE-2026-54478 affect system security?
CVE-2026-54478 can lead to a DNS Cookie bypass when combined with proxy protocol use, affecting the integrity of server responses.
What versions of software are affected by CVE-2026-54478?
CVE-2026-54478 affects NLnet Labs Unbound versions from 1.18.0 up to and including 1.25.1.
How do I fix CVE-2026-54478?
To mitigate CVE-2026-54478, upgrade to a patched version of NLnet Labs Unbound beyond 1.25.1.
What conditions trigger the vulnerability in CVE-2026-54478?
The vulnerability in CVE-2026-54478 is triggered when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes'.