CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

• CWE-349

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txtVendor Advisory

Published

Jul 22, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50243In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when…3.7
• CVE-2026-50244The Naxclow platform exposes a registration endpoint that ac…6.9
• CVE-2026-50245Brickcom cameras allow unauthenticated access to live snapsh…8.3
• CVE-2026-50248In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when…6.5
• CVE-2026-5025The '/logs' and '/logs-stream' endpoints in the log router a…6.5
• CVE-2026-50251In NLnet Labs Unbound up to and including version 1.25.1, wh…5.3
• CVE-2026-50254An unauthenticated remote attacker can repeatedly send a sin…8.7
• CVE-2026-50255Incorrect default permissions issue exists in Optical Disc A…6.7
• CVE-2026-50256A stack-based buffer overflow flaw was found in the X.Org X …7.8
• CVE-2026-50257A use-after-free flaw was found in the X.Org X server and Xw…7.8
• CVE-2026-50258A stack-based buffer overflow flaw was found in the X.Org X …7.8
• CVE-2026-50259A stack-based buffer overflow flaw was found in the X.Org X …7.8