CVE-2026-50252 is a critical (CVSS 9.3) weakness in NLnet Labs Unbound 1.4.22 through 1.25.1. With so-reuseport enabled, which is the default, the UDP source port reveals which worker thread handled a query, shrinking the random port space and aiding DNS cache poisoning. Upgrade to Unbound 1.25.2.
What's affected
- Product: NLnet Labs Unbound, the validating recursive DNS resolver.
- Affected: 1.4.22 up to and including 1.25.1.
- Fixed: 1.25.2. NLnet Labs also publishes patch files for 1.25.1 for people who build from source.
- Weakness: CWE-349, acceptance of extraneous untrusted data with trusted data.
- CVSS 9.3 (critical), vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H. The attack vector is adjacent network. - Published 22 July 2026. Not marked as exploited in CISA KEV.
The condition is so-reuseport: yes, which NLnet Labs says is the default in affected versions.
How to check if you're exposed
Check the version and the setting.
unbound -V
unbound-checkconf -o so-reuseport
The second command prints the effective value of the option from your configuration. If it prints yes, the condition in the advisory is met. Package based installs may report an older base version with fixes backported, so read your distribution's security tracker for this CVE.
Also check where your resolver listens. A resolver that serves only trusted clients on a private network has a smaller group of people who could observe the port mapping.
What to do now
- Upgrade Unbound to 1.25.2, or install the package your distribution has patched for this CVE.
- If you build from source and cannot move to 1.25.2, apply the patch NLnet Labs publishes for 1.25.1 and run make install, as described in the advisory.
- Limit which clients may query your resolver with access-control rules.
- Keep DNSSEC validation on where your zones support it, as it protects answers independent of source ports.
- Restart the service after upgrading and confirm the new version is running.
Why it matters
Source port randomization is a secret that makes it harder to forge DNS replies. The advisory explains the flaw: Unbound splits the port range among worker threads, and the kernel's SO_REUSEPORT feature sends each client port to a fixed thread. So the port seen on an outgoing query reveals which thread handled the request, and an observer can learn the mapping for a given client address.
Once the observer knows the thread, the number of ports to guess goes down. That makes cache poisoning cheaper. The fix in 1.25.2 uses a shared pool of ports per interface so the thread no longer leaks through the port. The record classifies this under CWE-349.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Do I need to turn off so-reuseport?
The advisory fix is the upgrade to 1.25.2. It does not present disabling the option as the remedy, so follow the advisory text.
Sources
Last reviewed: 19 October 2026.
