CVE-2026-50045
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jul 22, 2026
CISA due date
—
The record
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-45557 Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched… CWE-406
- GHSA-7hmv-4j2j-pp6f PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` CWE-406
- GHSA-h656-5vcf-cm23 OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before… CWE-406