From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:16:42 +0000 (+0200)
Subject: - Fix CVE-2026-54478, DNS Cookie bypass when combined with
X-Git-Tag: release-1.25.2~8
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=8a15ffee620bce05fbfd2c69b0d4c31c10a02431;p=thirdparty%2Funbound.git

- Fix CVE-2026-54478, DNS Cookie bypass when combined with
  proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
---

diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 9239f8fe3..7b2de102e 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -1068,13 +1068,13 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 			 * purposes. It will be overwritten if (re)creation
 			 * is needed.
 			 */
-			if(repinfo->remote_addr.ss_family == AF_INET) {
+			if(repinfo->client_addr.ss_family == AF_INET) {
 				memcpy(server_cookie + 16,
-					&((struct sockaddr_in*)&repinfo->remote_addr)->sin_addr, 4);
+					&((struct sockaddr_in*)&repinfo->client_addr)->sin_addr, 4);
 			} else {
 				cookie_is_v4 = 0;
 				memcpy(server_cookie + 16,
-					&((struct sockaddr_in6*)&repinfo->remote_addr)->sin6_addr, 16);
+					&((struct sockaddr_in6*)&repinfo->client_addr)->sin6_addr, 16);
 			}
 
 			if(cfg->cookie_secret_file &&