p PatchFirst

ALPINE-CVE-2026-50045

ALPINE-CVE-2026-50045

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.

CVSS 5.3 · Medium · Fix available

Published
Updated

Stack: system

Affected products and versions

  • unbound Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: ≥ 1.22.0, < 1.25.2-r0

    Update to 1.25.2-r0

  • unbound Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: ≥ 1.22.0, < 1.25.2-r0

    Update to 1.25.2-r0

  • unbound Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: ≥ 1.22.0, < 1.25.2-r0

    Update to 1.25.2-r0

Original sources

Check your server →