CVE-2026-50251

{
  "id": "CVE-2026-50251",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:20.503",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound hasta la versión 1.25.1 inclusive, cuando ’unwanted-reply-threshold’ está habilitado (establecido a cualquier valor mayor que cero), los registros glue de 0.0.0.0/::0 pueden provocar un cortocircuito en Unbound, en sistemas que pueden dirigir dicho tráfico, al emitir consultas DNS y recibir respuestas aparentemente no deseadas ya que la IP remota no coincide con la IP de origen original de 0.0.0.0/::0. Este comportamiento sigue en bucle para los registros glue y empujando el contador al ’unwanted-reply-threshold’ configurado que activa una limpieza defensiva de la caché. Un actor malicioso que controla una delegación que devuelve glue in-bailiwick de 0.0.0.0/::0 puede llevar el contador al umbral de ’unwanted-reply-threshold’ y activar una limpieza de la caché de mensajes y de los cachés de rrset; a voluntad, indefinidamente, sin enviar un solo paquete falsificado. El iterador utiliza el glue 0.0.0.0/::0, y un sistema que puede enrutar esto (por ejemplo, el kernel de Linux enruta el datagrama a través de loopback), el propio oyente de Unbound responde desde 127.0.0.1. Debido a la falta de coincidencia entre 0.0.0.0 y 127.0.0.1, en este ejemplo, Unbound considera la respuesta como una respuesta no deseada (probablemente falsificada). El contador se restablece a cero en cada vaciado de caché, por lo que el ataque se repite indefinidamente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:34:31.755779Z",
          "id": "CVE-2026-50251",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "9C01A425-F6D7-49A7-A72D-BF2159564DB6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}