Description
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.
Published: 2026-07-22
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability resides in the UDP source port randomization strategy of the Unbound DNS resolver. The random port allocation is intended to provide a secret value that increases entropy for DNS transactions. However, when the resolver’s load balancing policy depends on the source port while that same port is exposed in outgoing traffic, the secrecy is compromised. An attacker can determine which worker thread handled a query by observing the source port used in replies from and enabling a cache poisoning attack. The weakness is classified as CWE‑349.

Affected Systems

The affected product is NLnet Labs Unbound version 1.4.22 up to and including 1.25.1. Any installations using the default SO_REUSEPORT configuration in those releases are vulnerable.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is < 1% which indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to observe outgoing source ports to map worker threads. While the technical barrier is non‑trivial, the deterministic thread partitioning makes the attack feasible when the conditions are met.

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade NLnet Labs Unbound to version 1.25.2 or later
  • If an upgrade is not immediately possible, disable the SO_REUSEPORT option in the Unbound configuration to prevent deterministic thread‑based port partitioning
  • Avoid using DNS resolver load‑balancing policies that depend on client source ports while the resolver is in use

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.
Title Possible cache poisoning attack by mapping source port population per thread
Weaknesses CWE-349
References
Metrics cvssV4_0

{'score': 5.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber'}

Subscriptions

Nlnetlabs Unbound
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:18:36.928Z

Reserved: 2026-06-22T12:35:21.348Z

Link: CVE-2026-50252

cve-icon Vulnrichment

Updated: 2026-07-22T14:18:33.750Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:20.627

Modified: 2026-07-24T14:05:44.813

Link: CVE-2026-50252

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses
  • CWE-349

    Acceptance of Extraneous Untrusted Data With Trusted Data