CVE-2026-50251
Received Received - Intake

DNS Cache Poisoning in NLnet Labs Unbound

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-50251
EUVD
EUVD-2026-47675

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50251 affects NLnet Labs Unbound DNS software up to version 1.25.1. When the 'unwanted-reply-threshold' feature is enabled, a malicious actor controlling a delegation can return glue records of 0.0.0.0/::0. This causes Unbound to route traffic internally, receive replies from 127.0.0.1, and misclassify them as unwanted due to IP mismatch. The counter increments until it triggers a cache clear, resetting the counter and allowing the attack to repeat indefinitely without spoofed packets.

Detection Guidance

To detect this vulnerability, check if your Unbound version is 1.25.1 or earlier. Run 'unbound -V' to see the installed version. If enabled, monitor DNS query logs for repeated cache clears or unwanted reply thresholds being triggered.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by repeatedly clearing Unbound's DNS caches. This disrupts DNS resolution, causing delays or failures in accessing network resources. Systems relying on Unbound for DNS may experience degraded performance or outages during the attack.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It primarily affects DNS resolution reliability and availability by enabling denial-of-service conditions through cache clearing. Compliance risks would arise indirectly if DNS failures disrupt logging, authentication, or data processing systems subject to these regulations.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, apply the manual patch for version 1.25.1. Alternatively, disable the 'unwanted-reply-threshold' feature or add 0.0.0.0/::0 to the 'do-not-query-address' list manually.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart