CVE-2026-50045
Fixed in a distro release EPSS <1%CVSS 5.3
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.
Products: NLnet Labs unbound
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.22 | unbound | 1.25.2-r0 |
| Alpine 3.23 | unbound | 1.25.2-r0 |
| Alpine 3.24 | unbound | 1.25.2-r0 |
| Debian 12 | unbound | no fix |
| Debian 13 | unbound | 1.26.1-0+deb13u1 |
| Debian 14 | unbound | 1.25.2-1 |
| Red Hat hummingbird 1 | python3-unbound | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-anchor | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-devel | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-dracut | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-libs | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-munin | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-utils | 0:1.25.2-0.1.hum1 |
| SUSE Linux Enterprise Server 16.0 | unbound | 1.25.2-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | unbound | 1.25.2-160000.1.1 |
| SUSE Linux Micro 6.0 | unbound | 1.25.2-1.1 |
| SUSE Linux Micro 6.1 | unbound | 1.25.2-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | unbound | 1.25.2-160000.1.1 |
| Ubuntu 22.04 LTS | unbound | no fix |
| Ubuntu 24.04 LTS | unbound | no fix |
| Ubuntu 26.04 LTS | unbound | no fix |
| Ubuntu 26.10 | unbound | no fix |
| Ubuntu Pro 14.04 LTS | unbound | no fix |
| Ubuntu Pro 16.04 LTS | unbound | no fix |
| Ubuntu Pro 18.04 LTS | unbound | no fix |
| Ubuntu Pro 20.04 LTS | unbound | no fix |
| openSUSE Leap 16.0 | unbound | 1.25.2-160000.1.1 |
| openSUSE Tumbleweed | unbound | 1.25.2-1.1 |