CVE-2026-50045
Nlnetlabs Unbound 1.22.0 – 1.25.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-50045 is a medium-severity Network Amplification (CWE-406) vulnerability in Nlnetlabs Unbound. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-4 (System Monitoring) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-47671
Vulnerability Data
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively…
more
bypasses a security configuration that limits upstream amplification traffic.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Denial-of-service protection directly requires mechanisms to limit excessive outbound traffic volume that amplification attacks exploit.
System monitoring detects anomalous traffic volumes indicative of amplification after the weakness is present.
Boundary protection at managed interfaces enforces controls on communications volume and flow that can stop amplification.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Monitoring activities can detect anomalous traffic volumes, yet detection alone does not enforce control.
Logging provides visibility into high-volume traffic but does not itself limit or control it.
Network security controls include traffic filtering and rate-limiting that prevent amplification attacks.
Security of network services can impose volume controls on specific services, but does not address the weakness broadly.
Capacity management directly limits excessive outbound traffic that an actor could otherwise trigger.