The CVE number for this vulnerability is CVE-2026-50252.


== Summary
UDP source port is randomized and intended to serve as a secret value that
increases the entropy of DNS transactions.
When resolver load balancing policies depend on the source port while their
outcome is revealed this secrecy is undermined.
The vulnerability arises when the load balancing policy is consistent with
respect to the incoming source UDP port and IP address while heavily depending
on the incoming source UDP port as a randomization source.
When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in
Unbound (by default), it meets these conditions, making it vulnerable for DNS
cache poisoning attacks.

Unbound 1.25.2 includes a fix that makes a shared ports structure, with all
available ports per interface that the threads can then pick up a port number
from.


== Affected products
Unbound 1.4.22 up to and including version 1.25.1.


== Description
Upon startup, Unbound randomly partitions the available UDP source port space
into disjoint subsets of (almost) equal size, assigning each subset to a
specific worker thread.
When an incoming DNS query is received, the kernel’s SO_REUSEPORT load
balancing mechanism deterministically assigns the query to a socket associated
with a particular thread.
All outgoing DNS queries generated during the resolution of that request
use source ports selected exclusively from the port subset assigned to the
corresponding thread.
Since these port subsets are disjoint across threads, the source port observed
in a resolver’s outgoing query to an authoritative name server serves as
a reliable indicator of the worker thread that processed the original client
query.

A malicious actor can acquire the mapping between incoming UDP source ports
(for a given fixed source IP address) and Unbound worker threads and leverage
it to conduct DNS cache poisoning attacks by effectively lowering the random
port population per thread.

Unbound 1.25.2 includes a fix that makes a shared ports structure, with all
available ports per interface that the threads can then pick up a port number
from.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50252_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-50252_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-50252.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Inbal Schussheim and Amit Klein from Hebrew University
for discovering and responsibly disclosing the vulnerability.