PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50252 NLnet Labs CVE debrief

CVE-2026-50252 is a DNS cache poisoning vulnerability affecting Unbound versions 1.4.22 through 1.25.1. The issue arises when load balancing policies depend on the source UDP port while revealing their outcome, undermining the secrecy of DNS transactions. This occurs when the SO_REUSEPORT configuration option is enabled, allowing for deterministic assignment of incoming DNS queries to specific worker threads based on source ports. A malicious actor can exploit this by acquiring the mapping between incoming UDP source ports and Unbound worker threads, enabling DNS cache poisoning attacks.

Vendor
NLnet Labs
Product
Unbound
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Organizations using Unbound for DNS resolution should assess their configurations for SO_REUSEPORT and evaluate potential exposure to DNS cache poisoning attacks. This includes reviewing Unbound versions, checking for the SO_REUSEPORT configuration, and considering the impact on their DNS resolution infrastructure. Additionally, they should evaluate their current security controls and monitoring capabilities to detect potential exploitation attempts.

Technical summary

The vulnerability stems from Unbound's use of UDP source port randomization to increase DNS transaction entropy. When load balancing policies rely on source ports and SO_REUSEPORT is enabled, an attacker can infer the worker thread handling a query based on the source port of outgoing queries. This allows for targeted DNS cache poisoning attacks by reducing the effective randomness of source ports per thread.

Defensive priority

Medium priority due to the specific conditions required for exploitation and the availability of mitigations.

Recommended defensive actions

  • Review Unbound configurations for SO_REUSEPORT and assess potential exposure.
  • Implement compensating controls such as DNS query monitoring and validation.
  • Consider updating to a version of Unbound that addresses this vulnerability.
  • Conduct regular security audits and penetration testing to identify potential vulnerabilities.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its impact. Additional information from the vendor and security researchers may be necessary to fully understand the issue and develop effective mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50252 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50252

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50252 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50252

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.