Use of insufficiently random values in Unbound - CVE-2026-50252
Published: July 23, 2026
Vulnerability identifier: #VU139227
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-50252
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: NLnet Labs
Affected software:
Unbound
Unbound
Detailed vulnerability description
The vulnerability allows a remote attacker to conduct DNS cache poisoning attacks.
The vulnerability exists due to improper randomness management in UDP source port selection when handling DNS queries with the SO_REUSEPORT configuration option enabled. A remote attacker can send queries and observe outgoing source ports to conduct DNS cache poisoning attacks.
The issue occurs because worker threads use disjoint UDP source port subsets, allowing observed outgoing source ports to reveal which thread processed the original query.
How to mitigate CVE-2026-50252
Install security update from vendor's website.