CVE-2026-54478

CVE-2026-54478 affects NLnet Labs Unbound 1.18.0–1.25.1 when listening on a proxy-protocol-port with answer-cookie enabled. The RFC 9018 server-cookie (SipHash) is computed over the proxy’s wire address rather than the PROXYv2-declared client, causing a server cookie to validate for every PROXYv2...