CVE-2026-50045

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En NLnet Labs Unbound 1.22.0 hasta la versión 1.25.1 inclusive, una única consulta de cliente para un nombre profundamente anidado bajo un padre firmado con DNSSEC puede hacer que Unbound envíe más paquetes ascendentes por consulta de cliente que la ’max-global-quota’ configurada. Esto elude eficazmente una configuración de seguridad que limita el tráfico de amplificación ascendente.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-50045

Mitre link : CVE-2026-50045

CVE.ORG link : CVE-2026-50045

JSON object : View

Products Affected

nlnetlabs

unbound

CWE

CWE-406

Insufficient Control of Network Message Volume (Network Amplification)

{"id": "CVE-2026-50045", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50045", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:56:56.070257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:19.987", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt", "tags": ["Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-406"}]}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.22.0 hasta la versi\u00f3n 1.25.1 inclusive, una \u00fanica consulta de cliente para un nombre profundamente anidado bajo un padre firmado con DNSSEC puede hacer que Unbound env\u00ede m\u00e1s paquetes ascendentes por consulta de cliente que la \u2019max-global-quota\u2019 configurada. Esto elude eficazmente una configuraci\u00f3n de seguridad que limita el tr\u00e1fico de amplificaci\u00f3n ascendente."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C48102E-1D81-4A87-898D-F1CE83C78D26", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}