CVE-2026-50046 Overview
CVE-2026-50046 is a use-after-free vulnerability [CWE-416] in NLnet Labs Unbound, affecting versions 1.15.0 through 1.25.1. The flaw resides in the DNS-over-TLS (DoT) forwarding path, where the TLS server name string is owned by a serviced_query struct but referenced by a separate waiting_tcp struct. When the owning struct is jostled out of the mesh during an active TLS handshake, the string storage is freed. A subsequent TLS error dereferences the freed pointer, crashing the daemon and causing denial of service.
Critical Impact
A remote attacker who knows the DoT forwarding configuration can crash the Unbound resolver by triggering precisely timed queries against a configured stub or forward zone, resulting in denial of service for all downstream DNS clients.
Affected Products
- NLnet Labs Unbound 1.15.0 through 1.25.1
- Deployments configured with a DoT stub or forward zone
- Deployments using an #authname suffix on the server identification
Discovery Timeline
- 2026-07-22 - CVE-2026-50046 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-50046
Vulnerability Analysis
Unbound uses a mesh state machine to track outstanding recursive queries. For upstream DoT communication, each outbound request is represented by a serviced_query struct that owns configuration-derived data, including the TLS authentication name derived from the #authname suffix. A waiting_tcp struct holds a pointer to that same string while a TLS connection is negotiated.
When mesh pressure is high, Unbound jostles older or slower queries out of the mesh to make room for new work. Jostling a serviced_query frees the memory backing the TLS authentication string. If the associated TCP stream is still handshaking and later errors out, the error path reads the now-dangling pointer during connection teardown. The dereference is read-only, so no memory corruption occurs, but the invalid read crashes the daemon.
Root Cause
The root cause is a lifetime mismatch between two cooperating structures. The serviced_query struct owns the TLS server name allocation, while the waiting_tcp struct holds an unowned reference. No reference counting or copy-on-share protects the string across the asynchronous TLS handshake and jostle boundaries.
Attack Vector
Exploitation requires network reachability to the Unbound instance and knowledge of a zone forwarded over DoT with an #authname suffix. The attacker floods queries for records in the vulnerable zone while applying general query pressure so the jostle logic activates. Slow upstream answers for the target zone increase the window in which a query can be jostled mid-handshake. The upstream connection must exhibit a transient failure at the right moment to enter the error path that reads the freed pointer. Timing precision is required, which is reflected in the high attack complexity.
See the NLnet Labs CVE-2026-50046 Advisory for vendor technical details.
Detection Methods for CVE-2026-50046
Indicators of Compromise
- Unexpected termination or restart of the unbound daemon process with signals consistent with SIGSEGV.
- Bursts of queries targeting a specific zone that is configured for DoT forwarding, particularly under simultaneous high overall query load.
- Repeated TLS handshake failures or transient connectivity errors to the configured upstream DoT resolver.
Detection Strategies
- Correlate Unbound crash events with upstream TLS handshake failures logged around the same timestamps.
- Monitor query rates per forwarded zone and alert on statistical anomalies against baseline traffic.
- Enable core dump collection on resolver hosts and inspect crash backtraces for frames inside DoT and outside-network code paths.
Monitoring Recommendations
- Track unbound process uptime and restart counts through the service manager or a host telemetry agent.
- Ingest Unbound operational logs and upstream TLS error metrics into a centralized log platform for correlation.
- Alert when total DNS resolution failures spike alongside daemon restart events on the same host.
How to Mitigate CVE-2026-50046
Immediate Actions Required
- Upgrade Unbound to a version later than 1.25.1 that contains the vendor fix, once available from NLnet Labs.
- Inventory resolver configurations for any stub or forward zone using DoT with an #authname suffix.
- Restrict access to the resolver so only trusted clients can submit recursive queries.
Patch Information
Refer to the NLnet Labs CVE-2026-50046 Advisory for the fixed release version and patch details. Apply the vendor patch to all resolver instances running versions 1.15.0 through 1.25.1.
Workarounds
- Remove the #authname suffix from DoT forward or stub zone server entries where operationally acceptable, breaking the precondition for the vulnerable code path.
- Switch affected forwarding zones from DoT to plain DNS or DNS-over-HTTPS if regulatory and privacy requirements permit.
- Reduce mesh pressure by increasing num-queries-per-thread and related capacity settings so the jostle logic is less likely to trigger.
- Place the resolver behind rate limiting or access controls that prevent untrusted clients from generating query floods against the vulnerable zone.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
