Description
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
Published: 2026-07-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Unbound versions 1.9.0 through 1.25.1, an encryption routine handling DNSCrypt replies over TCP lacks bounds checking for reply length. A malicious query that triggers a response larger than 65504 bytes causes the routine to shift data by 48 bytes past the end of the pre‑allocated reply buffer, resulting in a heap overflow that crashes the resolver and denies service to all clients.

Affected Systems

The vulnerability affects Unbound from NLnet Labs, specifically releases 1.9.0 to 1.25.1 built with DNSCrypt support enabled through the '--enable-dnscrypt' compile flag and configured with a 'dnscrypt:' clause bound to a listening interface. Earlier or newer releases, or installations that do not enable DNSCrypt over TCP, are not impacted.

Risk and Exploitability

The CVSS score of 7.5 classifies the flaw as high severity, while the EPSS score of less than 1% and the absence from the KEV catalog indicate a low present exploitation probability. Nevertheless, the flaw is remotely exploitable: any host that can reach the server over TCP can send a single oversized encrypted DNSCrypt query, immediately crash the resolver, and drop service for all clients. The lack of authentication or additional prerequisites means an adversary can repeatedly target the DNS server to cause outages.

Generated by OpenCVE AI on August 3, 2026 at 23:50 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Apply the latest Unbound release (1.25.2 or newer) which includes bounds checking for DNSCrypt replies over TCP.
  • If an upgrade is not immediately feasible, disable DNSCrypt over TCP by removing the 'dnscrypt:' configuration clause or stopping the interface that listens for DNSCrypt traffic, thereby preventing the vulnerable code path from executing.
  • After applying the fix or disabling the feature, inspect the resolver logs for DNSCrypt‑related exceptions and perform controlled fuzz tests with oversized encrypted queries to confirm that the server no longer crashes.

Generated by OpenCVE AI on August 3, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
Title Packet of death for DNSCrypt over TCP
Weaknesses CWE-122
CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:31:26.565Z

Reserved: 2026-06-22T10:11:10.532Z

Link: CVE-2026-40691

cve-icon Vulnrichment

Updated: 2026-07-22T14:30:38.700Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:18.437

Modified: 2026-07-24T13:57:32.377

Link: CVE-2026-40691

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-40691 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses