Description
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').
Published: 2026-07-22
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unbound 1.7.0 through 1.25.1 contains a misconfiguration bug that triggers a memory corruption when the number of dnscrypt-provider-cert files exceeds the number of matching dnscrypt-secret-key files. The uninitialized memory is filled with 0xdb bytes; an attacker can send a single UDP datagram of at least 68 bytes whose first eight bytes are 0xdb to the dnscrypt port, causing Unbound to dereference garbage data and crash. This flaw is a classic uninitialized variable use (CWE‑457) and results in a silent crash without any authentication or privilege requirements.

Affected Systems

The vulnerability affects NLnet Labs Unbound versions 1.7.0 up to 1.25.1 when DNSCrypt support is enabled through the --enable-dnscrypt flag. The problem is mitigated in Unbound 1.25.2 and later.

Risk and Exploitability

The CVSS score is 5.9, indicating moderate severity. EPSS score is < 1%, indicating a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, relying on an unauthenticated UDP packet sent to the dnscrypt port. An attacker only needs to craft a packet with the specific byte pattern; no authentication or privilege requirements are needed. While the exploitation is feasible, no publicly disclosed exploits are known, and the server crash does not allow further compromise beyond denial‑of‑service.

Generated by OpenCVE AI on August 2, 2026 at 18:02 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Update Unbound to version 1.25.2 or later to receive the official fix
  • Verify that the number of dnscrypt-provider-cert files matches the number of dnscrypt-secret-key files in the configuration to prevent misconfiguration
  • If DNSCrypt support is unnecessary, disable it in the build or remove the dnscrypt-related entries to eliminate the code path

Generated by OpenCVE AI on August 2, 2026 at 18:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').
Title Packet of death for a DNSCrypt misconfigured Unbound
Weaknesses CWE-457
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nlnetlabs Unbound
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:04:28.690Z

Reserved: 2026-06-22T10:11:10.529Z

Link: CVE-2026-55990

cve-icon Vulnrichment

Updated: 2026-07-22T14:04:18.944Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:21.810

Modified: 2026-07-24T14:24:26.320

Link: CVE-2026-55990

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-22T13:10:01Z

Links: CVE-2026-55990 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T18:15:04Z

Weaknesses