CVE-2026-50045 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists in NLnet Labs Unbound DNS resolver versions 1.22.0 through 1.25.1 and represents a significant bypass of security mechanisms designed to prevent DNS amplification attacks. The flaw occurs when a single client query requests a deeply nested domain name that is signed with DNSSEC under a parent zone. Under normal circumstances, Unbound employs a 'max-global-quota' parameter to limit the number of upstream packets that can be generated per client query, serving as a critical defense against amplification attacks where malicious actors attempt to generate excessive traffic relative to their query volume.
The technical execution of this vulnerability involves exploiting the DNSSEC validation process within Unbound's resolver. When processing queries for deeply nested names under DNSSEC-signed zones, the resolver's internal state tracking fails to properly account for the additional upstream packets generated during the validation process. This results in the actual number of upstream packets exceeding the configured quota limit, effectively neutralizing the protective mechanism that should constrain amplification traffic.
The operational impact of this vulnerability is substantial as it allows attackers to bypass fundamental security controls designed to prevent DNS amplification attacks. This creates a potential vector for large-scale traffic amplification where malicious actors can generate significantly more upstream traffic than intended, potentially overwhelming network resources or serving as part of larger distributed denial-of-service campaigns. The vulnerability specifically targets the global quota enforcement mechanism, undermining the resolver's ability to control resource consumption and traffic generation patterns.
Security configurations that rely on the max-global-quota parameter become ineffective, leaving systems vulnerable to traffic amplification attacks that could be used against both the resolver itself and downstream networks. This bypass represents a critical flaw in the application's resource management and validation logic, particularly concerning how it handles DNSSEC-signed zones with deeply nested domain names.
The vulnerability aligns with CWE-1286, which addresses improper handling of DNSSEC validation in DNS resolvers, and relates to ATT&CK technique T1499.004 for network denial of service attacks through amplification. Organizations should immediately upgrade to Unbound versions beyond 1.25.1 where this issue has been resolved, as the patch addresses the core logic error in upstream packet accounting during DNSSEC validation for deeply nested names. Additionally, network administrators should monitor upstream traffic patterns and implement additional traffic shaping mechanisms as defensive measures while awaiting the upgrade process.
This flaw demonstrates the complexity of DNSSEC implementation and the potential for subtle logic errors to create significant security vulnerabilities. The resolution requires careful attention to how resolver state is maintained during complex validation scenarios, particularly when dealing with nested domains in signed zones. The vulnerability underscores the importance of thorough testing of security controls under various operational conditions, as the configuration-based protection mechanisms can be circumvented through specific query patterns that exploit implementation details rather than fundamental protocol weaknesses.