Possible cache poisoning attack by mapping source port population per thread

Summary

CVE	CVE-2026-50252
State	PUBLISHED
Assigner	NLnet Labs
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-07-22 14:17:20 UTC
Updated	2026-07-22 20:33:11 UTC
Description	In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Risk And Classification

Primary CVSS: v4.0 5.7 MEDIUM from [email protected]

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Problem Types: CWE-349 | CWE-349 CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Version	Source	Type	Score	Severity	Vector
4.0	[email protected]	Secondary	5.7	MEDIUM	`CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/C...`
4.0	CNA	CVSS	5.7	MEDIUM	`CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U...`

CVSS v4.0 Breakdown

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Confidentiality

None

Integrity

High

Availability

None

Sub Conf.

None

Sub Integrity

High

Sub Availability

High

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	NLnet Labs	Unbound	affected 1.4.22 1.25.2 semver	Not specified

References

Reference	Source	Link	Tags
www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt	[email protected]	www.nlnetlabs.nl
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Inbal Schussheim (Hebrew University) (en)

CNA: Amit Klein (Hebrew University) (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-04-23T00:00:00.000Z	Issue reported by Inbal Schussheim
CNA	2026-04-24T00:00:00.000Z	NLnet Labs shares patch
CNA	2026-04-29T00:00:00.000Z	Inbal Schussheim verifies patch
CNA	2026-07-22T00:00:00.000Z	Fixes released with version 1.25.2

Solutions

CNA: This issue is fixed starting with version 1.25.2

There are currently no legacy QID mappings associated with this CVE.