Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Unbound can allow DNS redirection through cache poisoning

published 3 months ago
Summary

The Unbound DNS resolver packages (unbound, unbound-devel, unbound-libs, unbound-python) can be tricked into accepting false DNS responses, letting an attacker redirect users to malicious sites. This happens when the resolver is configured with multiple threads and the reuse‑port option, which reduces the randomness of the outgoing network ports. Update to the latest Unbound release or disable the reuse‑port setting to protect your network.

What to do
  • Update oracle unbound to version 1.6.6-5.el7_8.tuxcare.els7.
  • Update oracle unbound-devel to version 1.6.6-5.el7_8.tuxcare.els7.
  • Update oracle unbound-libs to version 1.6.6-5.el7_8.tuxcare.els7.
  • Update oracle unbound-python to version 1.6.6-5.el7_8.tuxcare.els7.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:OracleLinux:7 oracle unbound < 1.6.6-5.el7_8.tuxcare.els7
Fix: upgrade to 1.6.6-5.el7_8.tuxcare.els7
TuxCare:OracleLinux:7 oracle unbound-devel < 1.6.6-5.el7_8.tuxcare.els7
Fix: upgrade to 1.6.6-5.el7_8.tuxcare.els7
TuxCare:OracleLinux:7 oracle unbound-libs < 1.6.6-5.el7_8.tuxcare.els7
Fix: upgrade to 1.6.6-5.el7_8.tuxcare.els7
TuxCare:OracleLinux:7 oracle unbound-python < 1.6.6-5.el7_8.tuxcare.els7
Fix: upgrade to 1.6.6-5.el7_8.tuxcare.els7
Original advisory text
unbound: Fix of CVE-2026-50252
- CVE-2026-50252: DNS cache poisoning via per-thread source port partitioning;
with 'so-reuseport: yes' and multiple threads the outgoing source port
revealed the worker thread, lowering effective port entropy
References
Timeline
Published30 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1785412633 · OSV
Track software like this
Free during beta