DNS Resolver Vulnerability in NLnet Labs Unbound

CVE-2026-50251

What is CVE-2026-50251?

A vulnerability exists in NLnet Labs Unbound where enabling 'unwanted-reply-threshold' can be exploited by malicious actors. By returning glue records of 0.0.0.0/::0, these actors can manipulate DNS query responses. This behavior can lead to a perpetual loop that triggers a cache clear, allowing the attacker to interfere with DNS operations without using spoofed packets. The flaw hinges on the response mismatch between the glue records and the system's loopback address, further complicating mitigation efforts.

References