CVE-2026-50251 NLnet Labs CVE debrief

Who should care

Users of Unbound DNS software, particularly those who have 'unwanted-reply-threshold' enabled, should be aware of this vulnerability and take steps to mitigate it. This includes updating Unbound to a version that is not vulnerable, disabling 'unwanted-reply-threshold' if not necessary, and monitoring Unbound logs for suspicious activity.

Technical summary

In Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled, glue records of 0.0.0.0/::0 can short-circuit Unbound, allowing a malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 to drive the counter to the limit of 'unwanted-reply-threshold' and trigger a cache clean of the message and rrset caches at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1.

Defensive priority

High

Recommended defensive actions

• Update Unbound to a version that is not vulnerable
• Disable 'unwanted-reply-threshold' if not necessary
• Monitor Unbound logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-22T14:17:20.503Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This information is based on the supplied source corpus and may not reflect the current status of the vulnerability. Users should verify the information with the official CVE record and NVD entry for the most up-to-date details.

Official resources