← Back

CVE-2026-50045

nvd nist
Published: Jul 22, 2026Modified: Jul 24, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: sep@nlnetlabs.nl (Secondary)

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

Affected (1)

Products: Nlnetlabs: Unbound
Nlnetlabs
1 product
Unbound
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Unbound
1.22.0 ≤ version < 1.25.2

Related CWEs

CWE-406
Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

References (1)

Source: sep@nlnetlabs.nl
Vendor Advisory

Timeline

No history available yet.