CVE-2026-50252: Unbound DNS Cache Poisoning Vulnerability

CVE-2026-50252 Overview

CVE-2026-50252 affects NLnet Labs Unbound versions 1.4.22 through 1.25.1. The vulnerability weakens the entropy of DNS transactions by leaking information about UDP source port randomization. When so-reuseport: yes is enabled (the default), the kernel deterministically maps incoming queries to worker threads. Each thread draws outgoing source ports from a disjoint subset assigned at startup. An adjacent-network attacker can profile this mapping and reduce the effective source port entropy per thread. The reduced entropy enables practical DNS cache poisoning attacks against the resolver. The flaw is classified under [CWE-349] Acceptance of Extraneous Untrusted Data With Trusted Data.

Critical Impact
Attackers can poison the Unbound DNS cache by exploiting deterministic worker-thread source port partitioning, redirecting clients to attacker-controlled hosts.

Affected Products

NLnet Labs Unbound 1.4.22 through 1.25.1
Unbound deployments with so-reuseport: yes (default configuration)
Multi-threaded Unbound resolvers exposed to adjacent-network attackers

Discovery Timeline

2026-07-22 - CVE-2026-50252 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-50252

Vulnerability Analysis

Unbound randomizes UDP source ports to add entropy to DNS transactions and defend against Kaminsky-style cache poisoning. The randomized port serves as a secret shared between the resolver and the authoritative server. This vulnerability breaks that secrecy assumption. When Unbound starts with SO_REUSEPORT enabled, it partitions the available UDP source port range into disjoint subsets. Each worker thread receives its own subset for outgoing queries. The Linux kernel's SO_REUSEPORT load balancer deterministically maps incoming (source IP, source port) tuples to a specific listening socket, and therefore to a specific worker. Because the outgoing port belongs to a thread-specific subset, the source port an authoritative server observes reveals which worker handled the client query. This binding leaks the mapping between client-side ports and worker threads.

Root Cause

The root cause is a design conflict between two randomization mechanisms. UDP source port randomization is meant to be a secret entropy source. The SO_REUSEPORT load-balancing policy is consistent with respect to source IP and port, and reveals its outcome through the outgoing port. Combining both mechanisms turns a secret value into an observable identifier, violating the trust assumption behind port randomization [CWE-349].

Attack Vector

An attacker with adjacent-network access sends probe queries from a fixed source IP address using different source ports. By observing outgoing queries reaching an authoritative name server they control, the attacker learns which incoming source ports map to which worker thread. Once the mapping is known, the attacker targets a single worker whose port subset is significantly smaller than the full 16-bit space. The reduced per-thread entropy makes it feasible to forge a response before the legitimate authoritative reply arrives and poison the cache with a spoofed record.

No public proof-of-concept code is available. Refer to the NLnet Labs CVE-2026-50252 Advisory for authoritative technical details.

Detection Methods for CVE-2026-50252

Indicators of Compromise

Bursts of DNS queries from a single external IP address using systematically varied source ports targeting the resolver.
Unexpected authoritative responses arriving from IP addresses not matching the delegated name servers for a zone.
Cache entries for high-value domains resolving to unfamiliar IP addresses or with anomalously short TTLs.
Elevated unwanted.reply counters in Unbound statistics indicating spoofed response attempts.

Detection Strategies

Monitor Unbound unbound-control stats output for spikes in num.query.tcp, unwanted.replies, and per-thread query counters.
Correlate outgoing query source ports with worker-thread identifiers using packet capture on the resolver's egress interface.
Deploy passive DNS monitoring to identify sudden changes in cached A, AAAA, or NS records for sensitive domains.

Monitoring Recommendations

Log all inbound UDP DNS traffic at the network perimeter and alert on scanning patterns across sequential source ports.
Enable DNSSEC validation logging and alert on validation failures, which may indicate poisoning attempts.
Ingest resolver telemetry into a centralized SIEM or data lake for longitudinal analysis of query and response patterns.

How to Mitigate CVE-2026-50252

Immediate Actions Required

Upgrade Unbound to a fixed release once NLnet Labs publishes a patched version referenced in the advisory.
Disable SO_REUSEPORT by setting so-reuseport: no in unbound.conf if a patch is not yet deployable.
Restrict resolver access to trusted client networks using access-control directives to limit adjacent-network exposure.
Enable DNSSEC validation on the resolver to detect forged responses for signed zones.

Patch Information

Refer to the NLnet Labs CVE-2026-50252 Advisory for the fixed release and upgrade instructions. Operators running Unbound 1.4.22 through 1.25.1 should upgrade to the vendor-designated patched version as soon as it is available.

Workarounds

Set so-reuseport: no in unbound.conf to disable the load-balancing behavior that leaks the thread-to-port mapping.
Reduce the worker thread count with num-threads: 1 where performance permits, removing the disjoint port partitioning.
Enforce strict access-control policies limiting recursive queries to authenticated internal clients.
Enable and enforce DNSSEC validation to reject unsigned or unsigned-parent forged responses.

bash

# Configuration example: mitigate CVE-2026-50252 in unbound.conf
server:
    so-reuseport: no
    harden-dnssec-stripped: yes
    val-permissive-mode: no
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse

# Apply changes
# unbound-checkconf /etc/unbound/unbound.conf
# systemctl restart unbound