The CVE number for this vulnerability is CVE-2026-50251.


== Summary
When 'unwanted-reply-threshold' is enabled (set to any value greater than
zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems
that can direct such traffic, by issuing DNS queries and receiving seemingly
unwanted replies since the remote IP does not match the original source IP of
0.0.0.0/::0.
This behavior keeps on looping for the glue records and pushing the counter
to the configured 'unwanted-reply-threshold' that triggers a defensive cache
clear.

Unbound 1.25.2 includes a fix to that implicitly adds 0.0.0.0/::0 to the
'do-not-query-address' by default.


== Affected products
Unbound up to and including version 1.25.1.


== Description
A malicious actor who controls a delegation that returns in-bailiwick glue of
0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold'
to the threshold and trigger a cache clean of the message and rrset caches;
at will, indefinitely, without sending a single spoofed packet.

The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g.,
Linux kernel routes the datagram over loopback), Unbound's own listener answers
from 127.0.0.1.
Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound
accounts the reply as an unwanted (probably spoofed) answer.
The counter resets to zero on every cache flush, so the attack loops forever.


Unbound 1.25.2 includes a fix to that implicitly adds 0.0.0.0/::0 to the
'do-not-query-address' by default.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50251_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50251_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50251.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.