{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-22T13:07:55Z",
  "bugzilla" : {
    "description" : "unbound: Unbound: Denial of Service via DNSSEC query amplification bypass",
    "id" : "2506136",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2506136"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-406",
  "details" : [ "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.", "A vulnerability in Unbound allows a remote attacker to bypass upstream amplification limits by querying a deeply nested name under a DNSSEC-signed parent. This triggers excessive outbound traffic per query, potentially causing a denial of service (DoS)." ],
  "statement" : "A Moderate flaw in Unbound allows remote attackers to bypass max-global-quota limits using crafted DNSSEC queries. This causes upstream traffic amplification, potentially leading to a Denial of Service (DoS). This issue specifically affects Unbound versions 1.22.0 through 1.25.1.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-22T00:00:00Z",
    "advisory" : "RHSA-2026:43588",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "unbound-main-1.25.2-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "unbound",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-50045\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50045\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt" ],
  "name" : "CVE-2026-50045",
  "mitigation" : {
    "value" : "Restrict recursive DNS access strictly to trusted networks using firewall access controls, reloading the service to apply changes. Additionally, configure Rate Limiting on outbound traffic to throttle anomalous spikes and mitigate amplification risks.",
    "lang" : "en:us"
  },
  "csaw" : false
}