CVE-2026-50252— Possible cache poisoning attack by mapping source port population per thread
Quick assessment
Affected
NLnet Labs Unbound
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.4.22版本至1.25.1版本存在信任管理问题漏洞，该漏洞源于UDP源端口随机化机制在启用SO_REUSEPORT负载均衡策略时可被利用，允许恶意行为者获取端口与工作线程的映射关系，从而降低每个线程的随机端口数量，容易受到DNS缓存中毒攻击。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | Unbound | 1.4.22< 1.25.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50252
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Possible cache poisoning attack by mapping source port population per thread
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.4.22版本至1.25.1版本存在信任管理问题漏洞，该漏洞源于UDP源端口随机化机制在启用SO_REUSEPORT负载均衡策略时可被利用，允许恶意行为者获取端口与工作线程的映射关系，从而降低每个线程的随机端口数量，容易受到DNS缓存中毒攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.4.22 ~ 1.25.2 | - |
|
II. Public POCs for CVE-2026-50252
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50252
请登录查看更多情报信息。
Other References for CVE-2026-50252 (1)
Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total
| CVE-2026-55973 | 7.5 HIGH | 'dns-error-reporting: yes' leads to stack buffer overflow |
| CVE-2026-32665 | 7.5 HIGH | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass |
| CVE-2026-40691 | 7.5 HIGH | Packet of death for DNSCrypt over TCP |
| CVE-2026-44690 | 7.5 HIGH | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation |
| CVE-2026-50248 | 6.5 MEDIUM | BOGUS configured primary hostname accepted for XFR in auth/rpz zones |
| CVE-2026-52863 | 5.9 MEDIUM | Memory corruption could lead to crash and denial of service |
| CVE-2026-55717 | 5.9 MEDIUM | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash |
| CVE-2026-55991 | 5.9 MEDIUM | Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 |
| CVE-2026-50046 | 5.9 MEDIUM | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out |
| CVE-2026-14586 | 5.9 MEDIUM | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments |
| CVE-2026-56444 | 5.9 MEDIUM | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout |
| CVE-2026-55990 | 5.9 MEDIUM | Packet of death for a DNSCrypt misconfigured Unbound |
| CVE-2026-44621 | 5.9 MEDIUM | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr |
| CVE-2026-50251 | 5.3 MEDIUM | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush |
| CVE-2026-50045 | 5.3 MEDIUM | 'max-global-quota' reset by DNSSEC validation restarts |
| CVE-2026-56416 | 4.8 MEDIUM | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name |
| CVE-2026-46582 | 3.7 LOW | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply |
| CVE-2026-44687 | 3.7 LOW | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi |
| CVE-2026-41637 | 3.7 LOW | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI |
| CVE-2026-54478 | 3.7 LOW | DNS Cookie bypass when combined with proxy-protocol use |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Unbound
-
CVE-2026-85501
Retrap: Novel Vulnerabilities to launch Algorithmic Complexi -
CVE-2026-82720
Use-after-free in DoH stream cleanup code path -
CVE-2026-82717
CNAME synthesis could lead to heap corruption -
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when -
CVE-2026-81634
Possible heap buffer overflow during DNSSEC canonicalization
Same vendor: NLnet Labs
-
CVE-2026-85501
Retrap: Novel Vulnerabilities to launch Algorithmic Complexi -
CVE-2026-82720
Use-after-free in DoH stream cleanup code path -
CVE-2026-82717
CNAME synthesis could lead to heap corruption -
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when -
CVE-2026-81634
Possible heap buffer overflow during DNSSEC canonicalization
Same weakness: CWE-349
-
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-78301
Out-of-zone database nodes can become authoritative zone cut -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers -
CVE-2026-41120
Dell Wyse Management Suite 信任管理问题漏洞
V. Comments for CVE-2026-50252
No comments yet