CVE-2026-50251

{"id": "CVE-2026-50251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:34:31.755779Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:20.503", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt", "tags": ["Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever."}, {"lang": "es", "value": "En NLnet Labs Unbound hasta la versi\u00f3n 1.25.1 inclusive, cuando \u2019unwanted-reply-threshold\u2019 est\u00e1 habilitado (establecido a cualquier valor mayor que cero), los registros glue de 0.0.0.0/::0 pueden provocar un cortocircuito en Unbound, en sistemas que pueden dirigir dicho tr\u00e1fico, al emitir consultas DNS y recibir respuestas aparentemente no deseadas ya que la IP remota no coincide con la IP de origen original de 0.0.0.0/::0. Este comportamiento sigue en bucle para los registros glue y empujando el contador al \u2019unwanted-reply-threshold\u2019 configurado que activa una limpieza defensiva de la cach\u00e9. Un actor malicioso que controla una delegaci\u00f3n que devuelve glue in-bailiwick de 0.0.0.0/::0 puede llevar el contador al umbral de \u2019unwanted-reply-threshold\u2019 y activar una limpieza de la cach\u00e9 de mensajes y de los cach\u00e9s de rrset; a voluntad, indefinidamente, sin enviar un solo paquete falsificado. El iterador utiliza el glue 0.0.0.0/::0, y un sistema que puede enrutar esto (por ejemplo, el kernel de Linux enruta el datagrama a trav\u00e9s de loopback), el propio oyente de Unbound responde desde 127.0.0.1. Debido a la falta de coincidencia entre 0.0.0.0 y 127.0.0.1, en este ejemplo, Unbound considera la respuesta como una respuesta no deseada (probablemente falsificada). El contador se restablece a cero en cada vaciado de cach\u00e9, por lo que el ataque se repite indefinidamente."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C01A425-F6D7-49A7-A72D-BF2159564DB6", "versionEndExcluding": "1.25.2"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}