CVE-2026-50046

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.

• CWE-416

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50046.txtVendor Advisory

Published

Jul 22, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50039The affected product is vulnerable to a stack-based buffer o…8.7
• CVE-2026-5004A vulnerability was determined in Wavlink WL-WN579X3-C 23112…8.8
• CVE-2026-50040Storage Concentrator (SC & SCVM) is vulnerable to reflected …6.1
• CVE-2026-50043Improper neutralization of special elements used in an OS co…8.6
• CVE-2026-50044Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inade…7.6
• CVE-2026-50045In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a s…5.3
• CVE-2026-5005Improper neutralization of input during web page generation …5.4
• CVE-2026-50052In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, …2.3
• CVE-2026-50058A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2026-50059A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2026-50060A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2026-50061A vulnerability has been identified in Solid Edge SE2025 (Al…7.8