CVE-2026-50045 - Vulnerability Details - OpenCVE

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NLnet Labs

Unbound

unaffected

Version	Status	Constraints
`1.22.0`	affected	< 1.25.2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

This issue is fixed starting with version 1.25.2

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt

History

Wed, 22 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 22 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.
Title		'max-global-quota' reset by DNSSEC validation restarts
Weaknesses		CWE-406
References		https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published: 2026-07-22T13:07:55.730Z

Updated: 2026-07-22T18:57:09.417Z

Reserved: 2026-06-22T12:27:22.806Z

Link: CVE-2026-50045

Vulnrichment

Updated: 2026-07-22T18:57:04.674Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-406

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50045", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-22T12:27:22.806Z", "datePublished": "2026-07-22T13:07:55.730Z", "dateUpdated": "2026-07-22T18:57:09.417Z"}, "containers": {"cna": {"title": "'max-global-quota' reset by DNSSEC validation restarts", "datePublic": "2026-07-22T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.22.0", "status": "affected", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-406", "description": "CWE-406: Insufficient Control of Network Message Volume (Network Amplification)", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "timeline": [{"time": "2026-05-07T00:00:00.000Z", "lang": "en", "value": "Issue reported by Kunjie Shang"}, {"time": "2026-06-15T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch"}, {"time": "2026-06-16T00:00:00.000Z", "lang": "en", "value": "Kunjie Shang verifies patch"}, {"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.25.2"}], "credits": [{"lang": "en", "value": "Kunjie Shang (University of Science and Technology of China)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:07:55.730Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T18:56:56.070257Z", "id": "CVE-2026-50045", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:57:09.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:56:56.070257Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:57:04.674Z"}}], "cna": {"title": "'max-global-quota' reset by DNSSEC validation restarts", "credits": [{"lang": "en", "type": "finder", "value": "Kunjie Shang (University of Science and Technology of China)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.22.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-07T00:00:00.000Z", "value": "Issue reported by Kunjie Shang"}, {"lang": "en", "time": "2026-06-15T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-16T00:00:00.000Z", "value": "Kunjie Shang verifies patch"}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Fixes released with version 1.25.2"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-406", "description": "CWE-406: Insufficient Control of Network Message Volume (Network Amplification)"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:07:55.730Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50045", "state": "PUBLISHED", "dateUpdated": "2026-07-22T18:57:09.417Z", "dateReserved": "2026-06-22T12:27:22.806Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-07-22T13:07:55.730Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}