CVE-2026-50252
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.
Risk Assessment
An attacker can exploit this vulnerability to perform DNS cache poisoning attacks, potentially redirecting network traffic to malicious servers and intercepting sensitive data.
Recommendation
Immediately upgrade Unbound to version 1.25.2 or later, which includes a fix for this vulnerability. As a temporary workaround, consider disabling the so-reuseport option in the configuration.
Other vulnerabilities in Unbound
See all- CVE-2026-81642Critical
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.
- CVE-2026-42960Critical
NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.
- CVE-2026-33278Critical
NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.
- CVE-2026-97206High
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
- CVE-2026-96405Medium
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message result in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
- CVE-2026-50106Medium
In NLnet Labs Unbound up to and including version 1.26.1, when configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
- CVE-2026-109125Medium
In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). When a response-like UDP datagram reaches the upstream source port currently used by a recursive query but its TXID does not match any pending query, Unbound counts it as an unwanted reply and, upon reaching the threshold, clears the worker's RRset and message caches, allowing an external observer to distinguish whether a candidate port matches the current upstream source port.
- CVE-2026-85501Medium
NLnet Labs Unbound up to and including 1.26.0 is vulnerable to algorithmic complexity attacks (known as 'ReTrap') that cause service degradation. Attacks include TagTrap (large number of mismatched DNSKEY, RRSIG, DS records), DelegationTrap (costly iterative validation for deeply nested domains), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (default validation of ADDITIONAL section).
- CVE-2026-82720Medium
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPS support with '--with-libnghttp2'. During failure code paths (e.g., RPZ drop, jostle), a dropped DoH stream brings down the whole DoH session and does not account properly for other streams, leading to use-after-free. An attacker can trigger it with a single DoH connection, but impact is limited as reads are not user controlled; however, a hardened allocator can catch the use-after-free and controllably terminate the process, causing DoS.
- CVE-2026-80225Medium
In NLnet Labs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Original NVD description (English source)
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS