Repository navigation
CVE-2026-54478 (Low) detected in src4.0.4 #472
Description
Activity
- changed the title
[-]CVE-2026-54478 (Low) detected in src4.0.4[/-][+]CVE-2026-54478 (Low) detected in src4.0.4 - autoclosed[/+]on Sep 18, 2026 ✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
- changed the title
[-]CVE-2026-54478 (Low) detected in src4.0.4 - autoclosed[/-][+]CVE-2026-54478 (Low) detected in src4.0.4[/+]on Oct 7, 2026 ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2026-54478 - Low Severity Vulnerability
MidnightBSD OS source code
Library home page: https://github.com/MidnightBSD/src.git
Found in base branches: stable/4.0, master
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
Publish Date: 2026-07-22
URL: CVE-2026-54478
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here