CVE-2026-50045
Received Received - Intake

Denial of Service in NLnet Labs Unbound DNS Server

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-50045
EUVD
EUVD-2026-47671

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-406 The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in NLnet Labs Unbound DNS software allows a single client query for a deeply nested DNS name under a DNSSEC-signed parent domain to send more upstream packets than the configured 'max-global-quota' permits. This bypasses a security limit designed to control upstream amplification traffic.

Detection Guidance

To detect this vulnerability, monitor Unbound logs for excessive upstream queries triggered by deeply nested DNSSEC-signed names. Check if query rates exceed configured 'max-global-quota' limits. Use commands like 'unbound-control stats' to inspect query counters and 'tcpdump' or 'Wireshark' to analyze DNS traffic patterns for amplification attempts.

Impact Analysis

An attacker could exploit this to send excessive upstream DNS queries, potentially causing network congestion, service disruption, or increased bandwidth usage. Systems relying on Unbound for DNS resolution may experience degraded performance or outages.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It primarily impacts DNS amplification attacks by bypassing upstream packet limits, which could indirectly lead to service disruptions or increased resource usage. Standards like GDPR and HIPAA focus on data protection and privacy, not DNS amplification risks.

Mitigation Strategies

Immediately upgrade Unbound to version 1.25.2 or later to apply the official fix. If upgrading is not possible, apply the manual patch provided by NLnet Labs to versions up to 1.25.1. Temporarily reduce 'max-global-quota' as a workaround until patching is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart