Unbound CVE-2026-50252

The SO_REUSEPORT option ('so-reuseport: yes') must be active in Unbound - this is the default configuration, so no special operator misconfiguration is required to be vulnerable. Unbound must be running with multiple worker threads (the default multi-threaded mode), as single-threaded deployments do not partition the port space and are not affected. The attacker must be network-adjacent to Unbound's outbound DNS path and able to passively observe UDP source ports on queries Unbound sends to authoritative name servers - this limits realistic attack positions to adversaries with ISP-level or peering-point-level access, BGP hijackers, or actors co-located on the same network segment as the resolver. Exploitation is further constrained by the need to conduct reconnaissance (building the thread-to-port mapping) before launching the cache poisoning phase, adding latency and increasing detection surface. DNSSEC-signed zones are protected even if poisoning succeeds, as Unbound will reject cryptographically invalid responses.

The CVSS 4.0 score of 5.7 (AV:A/AC:L/AT:P) reflects a realistic but bounded threat. The adjacent-network attack vector is the most significant limiting factor: the attacker must be positioned to observe Unbound's outgoing UDP traffic to authoritative name servers, restricting realistic threat actors to malicious ISPs, BGP-level adversaries, or network-adjacent actors at peering points. AT:P acknowledges specific preconditions (multi-threaded configuration with SO_REUSEPORT), though since SO_REUSEPORT is enabled by default, the default Unbound deployment is vulnerable without any operator misconfiguration. Downstream integrity impact is rated High (SI:H and VI:H), because successful cache poisoning can fully redirect all clients using the affected resolver. No EPSS score is provided in the available data, leaving quantitative exploitation probability unconfirmed. Proof-of-concept code exists (E:P), elevating practical risk above theoretical. The absence of a CISA KEV entry suggests exploitation is not yet widespread or confirmed in the wild, but the existence of POC code means the attack is within reach of sophisticated threat actors. The vulnerability does not eliminate source port randomization entirely - it reduces the effective per-thread port space - meaning the attack is harder than exploiting a fully predictable source port but significantly easier than brute-forcing a full 16-bit space, particularly against resolvers with many worker threads that create smaller per-thread subsets.

An attacker at a network-adjacent vantage point - such as an upstream ISP or BGP peer - sends a series of DNS queries to the target Unbound resolver from a fixed source IP address, monitors the UDP source ports Unbound uses for outgoing queries to authoritative name servers, and constructs the per-thread port-subset map. Armed with this mapping, the attacker identifies a specific target domain, triggers resolution, predicts the narrow port subset the handling thread will use, and floods the resolver with forged authoritative responses matching the reduced port range until one collides with the legitimate transaction ID, successfully poisoning the cache. Proof-of-concept code publicly demonstrating this attack technique exists.