Skip to main content

NLnet Labs Unbound CVE-2026-50045

| EUVDEUVD-2026-47671 MEDIUM
Insufficient Control of Network Message Volume (Network Amplification) (CWE-406)
2026-07-22 NLnet Labs GHSA-pjhw-m9f8-mwqg
Authentication Bypass Unbound Suse Red Hat
5.3
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

No authentication required to send DNS queries; availability impact is Low and scoped to the resolver's upstream behavior, not a crash or outage.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:51 vuln.today
CVE Published
Jul 22, 2026 - 13:07 cve.org
MEDIUM 5.3

DescriptionCVE.org

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

AnalysisAI

Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

Unbound (CPE: cpe:2.3:a:nlnet_labs:unbound) is a widely deployed validating, recursive, caching DNS resolver developed by NLnet Labs. When resolving a deeply nested DNS name (e.g., a.b.c.d.example.com) whose parent zone carries DNSSEC signatures, Unbound must walk the DNSSEC trust chain from the root downward, issuing upstream queries at each delegation point to fetch and validate DNSKEY and DS records. The 'max-global-quota' configuration parameter exists specifically to cap the total number of upstream packets the resolver will send on behalf of a single client query, limiting its potential as an amplification vector. CWE-406 (Insufficient Control of Network Message Volume / Message Amplification) identifies the root cause: the quota enforcement logic does not correctly bound cumulative upstream traffic when DNSSEC chain validation for deeply nested labels causes the packet count to grow beyond the configured ceiling. The result is that the rate-limiting safeguard can be exhausted or bypassed entirely by a single well-crafted query.

RemediationAI

The primary remediation is to upgrade Unbound to a version beyond 1.25.1 that includes the vendor-issued fix; the exact patched release version is not independently confirmed from the available data - consult the vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt for the specific target version before upgrading. While awaiting a patch, operators can reduce exposure by restricting which client IP ranges are permitted to send queries to the resolver (via access-control directives in unbound.conf), which limits the attacker's ability to trigger the amplification path. A stricter allowlist reduces attack surface but may break legitimate resolver access for open or semi-open configurations. Additionally, rate-limiting inbound queries at the network perimeter (e.g., using iptables or firewall rules on UDP/53 and TCP/53) can reduce the maximum per-client amplification throughput, though this does not fix the quota bypass itself. Monitoring upstream query volume for anomalous spikes per client IP is a useful detection measure.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-406 – Insufficient Control of Network Message Volume (Network Amplification)

View all
CVE-2022-0028 HIGH
8.6
CVE-2024-25015 HIGH
7.5
CVE-2020-10772 HIGH
7.5
CVE-2026-68080 MEDIUM
6.5
CVE-2025-58066 MEDIUM
5.3

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected

Share

CVE-2026-50045 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy