CVE-2026-50045: NLnet Labs Unbound DoS Vulnerability

CVE-2026-50045 Overview

CVE-2026-50045 affects NLnet Labs Unbound, an open-source recursive DNS resolver widely deployed in enterprise and service provider networks. The vulnerability spans versions 1.22.0 through 1.25.1. A remote attacker can send a single client query for a deeply nested name under a DNSSEC-signed parent zone. This query causes Unbound to generate more upstream packets than the max-global-quota configuration permits. The behavior bypasses a security control designed to limit upstream DNS amplification traffic. NLnet Labs published an advisory tracking this issue under CVE-2026-50045 Advisory.

Critical Impact
Attackers can bypass the max-global-quota protection to trigger disproportionate upstream DNS traffic, contributing to resource exhaustion and amplification abuse [CWE-406].

Affected Products

NLnet Labs Unbound 1.22.0
NLnet Labs Unbound versions between 1.22.0 and 1.25.1
NLnet Labs Unbound 1.25.1

Discovery Timeline

2026-07-22 - CVE-2026-50045 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-50045

Vulnerability Analysis

Unbound enforces a global quota through the max-global-quota directive. This directive caps the number of upstream packets the resolver sends per client query. The control exists to limit amplification and to contain runaway resolution paths. CVE-2026-50045 breaks this contract when the queried name is deeply nested beneath a DNSSEC-signed parent zone. Under those conditions Unbound issues additional upstream queries beyond the configured ceiling. The excess traffic bypasses the intended rate limit and increases outbound bandwidth consumption. The weakness maps to [CWE-406], Insufficient Control of Network Message Volume (Network Amplification).

Root Cause

The defect resides in how Unbound accounts for upstream packets during recursive resolution of deeply nested names under DNSSEC-signed parents. DNSSEC validation requires fetching signatures, keys, and delegation records at multiple zone cuts. The resolver's quota accounting does not correctly constrain the packet count generated across these validation steps. A single client query can therefore produce upstream traffic exceeding the operator-defined limit.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends a crafted recursive query to an exposed Unbound resolver. The query targets a deeply nested label sequence beneath a DNSSEC-signed zone the attacker controls or selects. Unbound then performs the full validation walk and emits more upstream packets than max-global-quota allows. Repeated queries amplify outbound traffic and can degrade availability for other resolver clients. Full exploitation details are documented in the NLnet Labs advisory.

Detection Methods for CVE-2026-50045

Indicators of Compromise

Sustained spikes in outbound DNS packets from Unbound resolvers not matched by client query volume.
Repeated recursive queries containing unusually long label chains under DNSSEC-signed parent zones.
Log entries showing upstream packet counts exceeding the configured max-global-quota for individual client queries.

Detection Strategies

Correlate client query rates against upstream packet rates and alert on ratios that exceed the expected max-global-quota ceiling.
Parse Unbound query logs for FQDNs with excessive label depth and known DNSSEC-signed parents.
Compare running Unbound versions across the fleet against the affected range 1.22.0 through 1.25.1.

Monitoring Recommendations

Enable Unbound verbosity sufficient to record upstream packet counts and validation activity per query.
Ship resolver metrics such as num.query.type and outbound packet counters to a centralized monitoring platform.
Baseline upstream bandwidth per resolver and alert on deviations that align with recursive amplification patterns.

How to Mitigate CVE-2026-50045

Immediate Actions Required

Inventory all Unbound instances and identify hosts running versions 1.22.0 through 1.25.1.
Apply the fixed Unbound release published by NLnet Labs as documented in the vendor advisory.
Restrict recursive service to trusted client networks using access-control directives until patching completes.

Patch Information

NLnet Labs published the fix and remediation guidance in the CVE-2026-50045 advisory. Operators should upgrade to the vendor-designated fixed release above 1.25.1 and restart the unbound service to apply the change.

Workarounds

Lower max-global-quota and related rate-limit values to reduce the size of any amplification window until the patch is deployed.
Enforce strict access-control rules so only authenticated internal clients can issue recursive queries.
Use upstream firewall rate limiting on outbound UDP/53 and TCP/53 from resolvers to cap amplification.

bash

# Configuration example: tighten quotas and access on Unbound
# /etc/unbound/unbound.conf
server:
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    max-global-quota: 128
    harden-dnssec-stripped: yes
    qname-minimisation: yes