NLnet Labs Unbound CVE-2026-50045

The queried hostname must be deeply nested (multiple label levels) under a DNSSEC-signed parent zone, as DNSSEC chain validation is what drives the excessive upstream packet generation. The attacker must be able to send DNS queries to the target Unbound resolver - for open or semi-open resolvers this requires only network reachability on UDP/TCP port 53; for internal resolvers it requires internal network access or a foothold on an authorized client. The operator must have max-global-quota configured for the bypass to be meaningful; without that setting, the amplification behavior still exists but there is no security control being bypassed. Exploitation is limited by the requirement that a suitably deep DNSSEC-signed zone be reachable from the resolver - an attacker with control of an authoritative zone can construct this; otherwise they must find an existing deeply nested DNSSEC zone. No authentication to Unbound is required (DNS queries are inherently unauthenticated) and no special client-side software is needed beyond a standard DNS query tool.

The NVD CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the limited direct impact on the resolver itself - availability impact is rated Low and scope remains unchanged. The real-world risk, however, lies in second-order effects: bypassing max-global-quota enables the resolver to become an amplification node, flooding upstream authoritative DNS servers with traffic disproportionate to client query volume. Operators who deployed max-global-quota specifically to constrain amplification exposure should treat this as a high-priority control-bypass, even though the base CVSS score is moderate. No EPSS score was provided in the source data, and no KEV listing or confirmed public exploit code exists, suggesting exploitation has not been observed at scale. The attack requires no authentication and no special client configuration - any DNS query sender reachable by the resolver can trigger this. The practical amplification magnitude depends on nesting depth and the structure of the target DNSSEC zone. Defenders relying on max-global-quota as a primary amplification mitigation should treat the effective score as higher than 5.3 given the security control bypass nature of the flaw.

An attacker sends a single DNS query to a vulnerable Unbound resolver asking for a record at a deeply nested hostname (such as a.b.c.d.e.f.g.dnssec-signed-zone.example) where the parent zone carries DNSSEC signatures. Unbound's DNSSEC validation logic initiates a chain of upstream queries to traverse delegation points, generating more upstream packets than the configured max-global-quota threshold before the limit is enforced. The attacker can repeat this with minimal client-side traffic, using the resolver as an amplifier against upstream authoritative DNS infrastructure. No public proof-of-concept code has been identified, but the attack is conceptually straightforward to implement given the public description.