Unbound 1.9.01.25.1 DNSCrypt TCP DoS
CVE-2026-40691 Published on July 22, 2026

Packet of death for DNSCrypt over TCP
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.

Vendor Advisory NVD

Timeline

Issue reported by Qifan Zhang

NLnet Labs shares patch with Qifan Zhang 23 days later.

Qifan Zhang verifies patch 3 days later.

Issue reported by Trung Nguyen 17 days later.

NLnet Labs shares patch with Trung Nguyen 2 days later.

Trung Nguyen suggests extra fixes

NLnet Labs shares new version of the patch with Trung Nguyen 1 day later.

Trung Nguyen verifies patch 1 day later.

Fixes released with version 1.25.2 18 days later.

Weakness Types

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2026-40691 has been classified to as a Memory Corruption vulnerability or weakness.


Products Associated with CVE-2026-40691

Want to know whenever a new CVE is published for Nlnetlabs Unbound? stack.watch will email you.

Nlnetlabs Unbound
 

Affected Versions

NLnet Labs Unbound: