CVE-2026-50251: CWE-184: Incomplete List of Disallowed Inputs in NLnet Labs Unbound
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.
AI Analysis
Technical Summary
CVE-2026-50251 describes a vulnerability in NLnet Labs Unbound DNS resolver up to version 1.25.1 where enabling 'unwanted-reply-threshold' allows an attacker controlling a delegation with in-bailiwick glue records of 0.0.0.0/::0 to cause Unbound to repeatedly flush its message and rrset caches. This occurs because Unbound treats replies from these glue records as unwanted due to IP mismatches (e.g., 0.0.0.0 vs. 127.0.0.1), incrementing a counter that triggers cache clearing. The counter resets after each flush, enabling an indefinite denial of service without spoofed packets.
Potential Impact
The vulnerability results in a denial of service condition by forcing Unbound to continuously clear its DNS caches, degrading DNS resolution performance and potentially causing service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the 'unwanted-reply-threshold' feature or carefully monitoring configurations that enable it to mitigate the risk of this cache flush loop attack.
CVE-2026-50251: CWE-184: Incomplete List of Disallowed Inputs in NLnet Labs Unbound
Description
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-50251 describes a vulnerability in NLnet Labs Unbound DNS resolver up to version 1.25.1 where enabling 'unwanted-reply-threshold' allows an attacker controlling a delegation with in-bailiwick glue records of 0.0.0.0/::0 to cause Unbound to repeatedly flush its message and rrset caches. This occurs because Unbound treats replies from these glue records as unwanted due to IP mismatches (e.g., 0.0.0.0 vs. 127.0.0.1), incrementing a counter that triggers cache clearing. The counter resets after each flush, enabling an indefinite denial of service without spoofed packets.
Potential Impact
The vulnerability results in a denial of service condition by forcing Unbound to continuously clear its DNS caches, degrading DNS resolution performance and potentially causing service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the 'unwanted-reply-threshold' feature or carefully monitoring configurations that enable it to mitigate the risk of this cache flush loop attack.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-06-22T12:27:22.791Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60c4229c2644c7f80e9244
Added to database: 07/22/2026, 13:22:42 UTC
Last enriched: 07/22/2026, 13:39:49 UTC
Last updated: 07/22/2026, 21:49:50 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.