Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-50252
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 10:34 UTC · Revision 1

Source evidence

CVE-2026-50252

core-osv · Original source

Published 22 Jul 2026, 14:17 UTC

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between

osv:CVE-2026-50252
Complete source record
{
  "id": "03831025e9e95b2e98880f0fa58d0e65ebab73a5226d1fc89679e3aa17bd0ce2",
  "url": "https://osv.dev/vulnerability/CVE-2026-50252",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-50252",
    "summary": "In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between",
    "evidence": "osv:CVE-2026-50252",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-50252",
      "aliases": [
        "CVE-2026-50252"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nlnetlabs/unbound",
              "type": "GIT",
              "events": [
                {
                  "introduced": "23318c4f2a74685f64546d6b191aeb701739a7c0"
                },
                {
                  "fixed": "c33ad1b1a21e48bfe4f140e90252a9be1b0c5745"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.4.22"
                      },
                      {
                        "fixed": "1.25.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "release-1.25.1",
            "release-1.25.0",
            "release-1.25.0rc1",
            "release-1.24.0",
            "release-1.24.0rc1",
            "release-1.23.0rc1",
            "release-1.22.0",
            "release-1.22.0rc1",
            "release-1.21.0",
            "release-1.21.0rc1",
            "release-1.20.0rc1",
            "release-1.20.0",
            "release-1.19.3rc1",
            "release-1.19.0rc1",
            "release-1.19.0",
            "release-1.18.0",
            "release-1.18.0rc1",
            "release-1.16.2",
            "release-1.16.1rc1",
            "release-1.16.1",
            "release-1.16.0rc1",
            "release-1.16.0",
            "release-1.15.0rc1",
            "release-1.15.0",
            "release-1.14.0rc1",
            "release-1.14.0",
            "release-1.13.2",
            "release-1.13.2rc1",
            "release-1.13.1rc2",
            "release-1.13.1",
            "release-1.13.1rc1",
            "release-1.13.0rc4",
            "release-1.13.0rc3",
            "release-1.13.0rc2",
            "release-1.13.0rc1",
            "release-1.12.0rc1",
            "release-1.12.0",
            "release-1.11.0rc1",
            "release-1.11.0",
            "1.11.0rc1",
            "release-1.10.0rc2",
            "release-1.10.0rc1",
            "release-1.9.6",
            "release-1.9.6rc1",
            "release-1.9.3rc2",
            "release-1.9.3",
            "release-1.9.3rc1",
            "release-1.9.2",
            "release-1.9.2rc3",
            "release-1.9.2rc1",
            "release-1.9.2rc2",
            "final-svn-state",
            "release-1.9.1rc1",
            "release-1.9.0rc1",
            "release-1.8.2rc1",
            "release-1.8.1rc1",
            "release-1.8.0rc1",
            "release-1.7.3rc1",
            "release-1.7.2rc1",
            "release-1.7.1rc1",
            "release-1.7.0rc3",
            "release-1.7.0rc2",
            "release-1.7.0rc1",
            "release-1.6.7",
            "release-1.6.7rc1",
            "release-1.6.6rc2",
            "release-1.6.6rc1",
            "release-1.6.4rc2",
            "release-1.6.4rc1",
            "release-1.6.2rc1",
            "release-1.6.1rc3",
            "release-1.6.1rc2",
            "release-1.6.1rc1",
            "release-1.6.0rc1",
            "release-1.5.10rc1",
            "release-1.5.10",
            "release-1.5.9rc1",
            "release-1.5.8rc1",
            "release-1.5.8",
            "release-1.5.7",
            "release-1.5.6",
            "release-1.5.6rc1",
            "release-1.5.5",
            "release-1.5.5rc1",
            "release-1.5.4rc1",
            "release-1.5.4",
            "release-1.5.3rc1",
            "release-1.5.2",
            "release-1.5.2rc1",
            "release-1.5.1",
            "release-1.5.1rc2",
            "release-1.5.1rc1",
            "release-1.5.0rc1",
            "release-1.4.22"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50252.json"
          }
        }
      ],
      "modified": "2026-10-26T02:30:51.861798475Z",
      "provider": "osv",
      "references": [
        "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-50252",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 446675,
  "published_at": "2026-07-22T14:17:20.627+00:00"
}