Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-50045

'max-global-quota' reset by DNSSEC validation restarts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NLnet Labs

Description

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NLnet Labs Unbound

Default version status: unaffected

  • 1.22.0 to < 1.25.2affected

References