An Unbound DNS server configured with 'unwanted-reply-threshold' greater than zero can unintentionally expose a cache‑level side channel. When a UDP datagram with a mismatched transaction ID but matching the source port of an in‑flight recursive query arrives, Unbound marks it as an unwanted reply. Once the number of such unwanted replies reaches the configured threshold, the server clears its RRset and message caches, yet retains the pending query. An external observer can detect whether the cache was cleared, thereby revealing whether a candidate port was the upstream source port for a recursive query. The attacker can use this information to filter source ports and then perform birthday‑style guessing of transaction IDs, which could lead to a cache poisoning attack that inserts incorrect DNS replies into the resolver's cache. This vulnerability enables an attacker to observe cache state changes, providing information disclosure of upstream port usage and a potential integrity breach via cache poisoning. The side channel is not enabled by default and relies on the configuration value of 'unwanted-reply-threshold', so its impact is contingent on the server’s configuration. In summary, the vulnerability introduces a medium‑severity risk that can be exploited to compromise DNS resolution correctness in scenarios where an attacker can keep multiple concurrent query windows open, but it is unlikely to be feasible against default or commonly recommended configurations.

NLnet Labs Unbound DNS servers up to and including version 1.26.1 are affected when the configuration option 'unwanted-reply-threshold' is set to a value greater than zero. Servers with the default setting (threshold zero or feature disabled) are not vulnerable.

The CVSS score of 5.3 categorizes this issue as medium severity. Because the exploit depends on a non‑default configuration and requires maintaining a concurrent query window, the practical likelihood of exploitation is moderate and not widely exploited in the public domain. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. A Remote Network attacker can trigger the side channel by sending UDP packets to the DNS server, but they must also maintain a live query to differentiate cache clear events. Thus, while the theoretical attack path exists, the risk is limited by configuration constraints. Security teams should treat the medium CVSS score and the evidence of a side channel as a reminder that configuration management and patching remain critical to mitigating potential integrity attacks on DNS services.