SB2026080743 - openEuler update for unbound

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080743

SB2026080743 - openEuler update for unbound

Published: August 7, 2026

Security Bulletin ID SB2026080743
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of insufficiently random values (CVE-ID: CVE-2026-50252)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to conduct DNS cache poisoning attacks.

The vulnerability exists due to improper randomness management in UDP source port selection when handling DNS queries with the SO_REUSEPORT configuration option enabled. A remote attacker can send queries and observe outgoing source ports to conduct DNS cache poisoning attacks.

The issue occurs because worker threads use disjoint UDP source port subsets, allowing observed outgoing source ports to reveal which thread processed the original query.


Remediation

Install update from vendor's website.

References