In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue… (CVE-2026-50251)

In NLnet Labs Unbound versions up to 1.25.1, enabling 'unwanted-reply-threshold' with a value greater than zero allows an attacker controlling a DNS delegation to return in-bailiwick glue records of 0.0.0.0/::0. On systems routing such traffic (e.g., Linux routing to loopback), Unbound receives replies from its own listener IP (e.g., 127.0.0.1) that do not match the glue record IP, causing Unbound to count these as unwanted replies. When the counter reaches the configured threshold, Unbound clears its message and rrset caches defensively. Because the counter resets after each cache flush, the attacker can cause an indefinite loop of cache clearing without sending spoofed packets, effectively disrupting DNS resolution.

The vulnerability allows a remote attacker who controls a DNS delegation to cause Unbound to repeatedly flush its DNS caches indefinitely. This results in denial of service by preventing effective DNS caching, which can degrade DNS resolution performance and reliability. There is no impact on confidentiality or integrity, and no spoofed packets are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or carefully configuring the 'unwanted-reply-threshold' feature to avoid triggering this behavior. Monitor vendor communications for official patches or updates addressing this issue.