CVE-2026-50251

A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service (DoS) for DNS resolution.

This Moderate flaw in Unbound allows a remote attacker to trigger a denial of service by controlling a DNS delegation. When the unwanted-reply-threshold option is enabled, specially crafted glue records can cause Unbound to repeatedly clear its DNS caches, disrupting DNS resolution. This occurs due to Unbound's internal handling of locally routed 0.0.0.0/::0 glue records, which are incorrectly flagged as unwanted replies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure Unbound to disable the unwanted-reply-threshold option by setting it to 0 in the unbound.conf file. This prevents the cache clearing behavior triggered by malicious glue records. After modifying the configuration, restart the Unbound service for the changes to take effect.