CVE-2026-40691 Details
Description
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
A denial-of-service vulnerability has been identified in Unbound versions 1.9.0 through 1.25.1, when compiled with DNSCrypt support. The issue arises in the handling of DNSCrypt queries received over TCP, where the reply length is not properly bounded before being written to the buffer. This flaw allows a reply larger than 65504 bytes to be shifted forward by 48 bytes, overwriting memory beyond the allocated heap space. As a result, a single malicious encrypted query can crash the resolver, leading to a denial-of-service condition. The vulnerability requires Unbound to be compiled with DNSCrypt support and the 'dnscrypt:' clause to be enabled for the listening interfaces.
Users can upgrade to Unbound version 1.25.2, which includes the necessary fixes. Alternatively, for those using Unbound 1.25.1, a patch is available that addresses this vulnerability. Instructions for applying the patch are included in the vulnerability disclosure.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40691.txt | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nlnetlabs unbound | >= 1.9.0, < 1.25.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |