The CVE number for this vulnerability is CVE-2026-50045.


== Description
A single client query for a deeply nested name under a DNSSEC-signed parent
can cause Unbound to send more upstream packets per client query than the
configured 'max-global-quota'.

This effectively bypasses a security configuration that limits upstream
amplification traffic.

Unbound 1.25.2 includes a fix to continue counting the global quota counter
across validator subqueries and also for validator query lookup restarts.


== Affected products
Unbound 1.22.0 up to and including version 1.25.1.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50045.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50045.diff
then run 'make install' to install Unbound.

The patch is tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Kunjie Shang from the University of Science
and Technology of China for discovering and responsibly disclosing the
vulnerability.