CVE-2026-54478

A flaw was found in Unbound. When Unbound is configured to listen on a proxy-protocol port with DNS cookies enabled, it incorrectly computes the server cookie using the proxy's network address instead of the actual client's address. This vulnerability allows an off-path attacker to harvest a valid server cookie and replay it from a spoofed source, effectively bypassing DNS Cookie security checks intended to prevent DNS spoofing.

This Low impact flaw in Unbound occurs when the DNS resolver is configured to use both proxy-protocol-port and answer-cookie: yes. The server cookie is incorrectly derived from the proxy's address, enabling an off-path attacker to bypass DNS Cookie security by replaying a harvested cookie. This vulnerability requires a specific, non-default configuration and has high attack complexity, limiting its impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid enabling answer-cookie: yes when Unbound is configured to listen on a proxy-protocol-port. If the proxy-protocol-port is essential, consider disabling DNS cookies. If both features are required, ensure the proxy infrastructure is secured and trusted. A restart of the Unbound service is required for configuration changes to take effect.