PatchSiren cyber security CVE debrief

CVE-2026-54478 NLnet Labs CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T14:17:21.177Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This vulnerability affects Unbound versions 1.18.0 through 1.25.1, specifically when configured with a 'proxy-protocol-port' interface and 'answer-cookie: yes'. The server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client IP, allowing an off-path attacker to harvest and replay server cookies, bypassing DNS Cookie checks.

Vendor: NLnet Labs
Product: Unbound
CVSS: LOW 3.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-22
Original CVE updated: 2026-07-22
Advisory published: 2026-07-22
Advisory updated: 2026-07-22

Who should care

Organizations using Unbound 1.18.0-1.25.1 with proxy-protocol-port interfaces and answer-cookie: yes configured should verify their deployments and consider updating to a patched version. Affected operators, platforms, and security teams should review the vulnerability and implement necessary mitigations.

Technical summary

In Unbound 1.18.0-1.25.1, when configured with a 'proxy-protocol-port' interface and 'answer-cookie: yes', the server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client IP. This allows an off-path attacker to harvest a server cookie with a single legitimate query and then replay it under any spoofed source, bypassing DNS Cookie checks intended to prevent such attacks. The vulnerability has a CVSS score of 3.7, indicating Low severity.

Defensive priority

Low priority due to CVSS score of 3.7 (Low severity). However, organizations should still verify their deployments and consider updating to a patched version.

Recommended defensive actions

Verify Unbound configurations for proxy-protocol-port interfaces with answer-cookie: yes
Consider updating to a patched version of Unbound
Monitor DNS traffic for suspicious cookie usage
Implement additional security measures to detect and prevent off-path attacks
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the official reference (https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt) may be necessary for a more detailed understanding. The official reference from [email protected] regarding CVE-2026-54478 should be reviewed for additional context. Evidence is limited, and defenders should verify affected scope and vendor guidance.