{
  "cveId": "CVE-2026-50251",
  "url": "https://patchblox.com/security/cve/CVE-2026-50251",
  "summary": "CVE-2026-50251 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-50251, released July 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Attacker supplied \u00270.0.0.0\u0027/\u0027::\u0027 glue triggers defensive full-cache flush",
  "description": "In NLnet Labs Unbound up to and including version 1.25.1, when \u0027unwanted-reply-threshold\u0027 is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0027unwanted-reply-threshold\u0027 that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0027unwanted-reply-threshold\u0027 to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0027s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.",
  "published": "2026-07-22T14:17:20Z",
  "severity": "Moderate",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe": "Incomplete List of Disallowed Inputs",
  "epss": 0.00254,
  "epssPercentile": 0.16991,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50251",
  "fixes": [
    {
      "platform": "linux",
      "product": "python3-unbound",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-unbound-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.26.1-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-50251",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-50251",
      "released": "2026-07-28T14:13:38Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 14",
      "fixedVersion": "1.25.2-1",
      "fix": "DEBIAN-CVE-2026-50251",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-50251",
      "released": "2026-07-28T14:13:38Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.25.2-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21550-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21550-1",
      "released": "2026-08-10T15:27:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.6",
      "fixedVersion": "1.25.2-150600.23.19.1",
      "fix": "SUSE-SU-2026:3885-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3885-1",
      "released": "2026-08-31T14:34:37Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.7",
      "fixedVersion": "1.25.2-150600.23.19.1",
      "fix": "SUSE-SU-2026:3885-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3885-1",
      "released": "2026-08-31T14:34:37Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 16.0",
      "fixedVersion": "1.25.2-160000.1.1",
      "fix": "SUSE-SU-2026:23226-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23226-1",
      "released": "2026-08-10T15:26:22Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-libs",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-utils",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-utils-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.13",
      "fix": "ALAS2023-2026-2033",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2033",
      "released": "2026-08-03T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}