{
  "threat_severity" : "Low",
  "public_date" : "2026-07-22T13:09:18Z",
  "bugzilla" : {
    "description" : "unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation",
    "id" : "2506146",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2506146"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-303",
  "details" : [ "In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.", "A flaw was found in Unbound. When Unbound is configured to listen on a proxy-protocol port with DNS cookies enabled, it incorrectly computes the server cookie using the proxy's network address instead of the actual client's address. This vulnerability allows an off-path attacker to harvest a valid server cookie and replay it from a spoofed source, effectively bypassing DNS Cookie security checks intended to prevent DNS spoofing." ],
  "statement" : "This Low impact flaw in Unbound occurs when the DNS resolver is configured to use both `proxy-protocol-port` and `answer-cookie: yes`. The server cookie is incorrectly derived from the proxy's address, enabling an off-path attacker to bypass DNS Cookie security by replaying a harvested cookie. This vulnerability requires a specific, non-default configuration and has high attack complexity, limiting its impact.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-22T00:00:00Z",
    "advisory" : "RHSA-2026:43588",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "unbound-main-1.25.2-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-54478\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54478\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt" ],
  "name" : "CVE-2026-54478",
  "mitigation" : {
    "value" : "To mitigate this issue, avoid enabling `answer-cookie: yes` when Unbound is configured to listen on a `proxy-protocol-port`. If the `proxy-protocol-port` is essential, consider disabling DNS cookies. If both features are required, ensure the proxy infrastructure is secured and trusted. A restart of the Unbound service is required for configuration changes to take effect.",
    "lang" : "en:us"
  },
  "csaw" : false
}