{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-50251-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-10-28T11:32:52Z", "generator": { "date": "2026-10-28T11:32:52Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-50251-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-07-22T14:17:00Z", "revision_history": [ { "date": "2026-07-22T14:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T11:32:52Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-50251" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" }, { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-libs@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-devel@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-python@1.4.20-29.el6_10.1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-libs@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-devel@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/unbound-python@1.4.20-29.el6_10.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-50251", "cwe": { "id": "CWE-184", "name": "Incomplete List of Disallowed Inputs" }, "notes": [ { "category": "description", "text": "In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-50251" }, { "category": "external", "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt" } ], "release_date": "2026-07-22T14:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-25T11:17:42.328046Z", "details": "This issue only applies when Unbound’s unwanted-reply-threshold is explicitly enabled; the default is 0 (disabled), so standard configurations are not affected. Successful exploitation also relies on OS behavior that routes 0.0.0.0/::0 to loopback and on the resolver actually querying an attacker‑controlled delegation returning such glue, which adds significant preconditions and reduces practical reach in managed server/VM deployments. Even if triggered, the impact is limited to cache flush loops (availability only) with no confidentiality or integrity compromise.", "product_ids": [ "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "Oracle-Linux-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] } ] } ] }