CVE-2026-50252

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.4.22 through 1.25.1

Description An issue exists where the secrecy of the randomized UDP source port, used to increase entropy in DNS transactions, is undermined when resolver load balancing policies depend on the source port. This occurs when the so-reuseport: yes configuration option is enabled, which is the default setting. Unbound partitions the UDP source port space into disjoint subsets assigned to specific worker threads. Because the kernel's SO REUSEPORT mechanism deterministically assigns queries to threads, the source port of an outgoing query to an authoritative name server reveals which worker thread processed the original client query. A malicious actor can map incoming UDP source ports to specific worker threads to facilitate DNS cache poisoning attacks by reducing the effective random port population per thread.

Recommendations For versions 1.4.22 through 1.25.1, disable the so-reuseport option by setting it to no in the configuration to mitigate the risk of DNS cache poisoning.