Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs
CVE-2026-40691Packet of death for DNSCrypt over TCP
High 7.5
In plain English
A high-severity heap buffer overflow in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | unbound | no fix listed | DEBIAN-CVE-2026-40691 |
| Debian:13 | unbound | 1.26.1-0+deb13u1 | DEBIAN-CVE-2026-40691 |
| Debian:14 | unbound | 1.25.2-1 | DEBIAN-CVE-2026-40691 |
| Ubuntu:22.04:LTS | unbound | 1.13.1-1ubuntu5.17 | USN-8946-1 |
| Ubuntu:22.04:LTS | unbound | 1.13.1-1ubuntu5.17 | UBUNTU-CVE-2026-40691 |
| Ubuntu:24.04:LTS | unbound | 1.19.2-1ubuntu3.12 | USN-8946-1 |
| Ubuntu:24.04:LTS | unbound | 1.19.2-1ubuntu3.12 | UBUNTU-CVE-2026-40691 |
| Ubuntu:26.04:LTS | unbound | 1.24.2-1ubuntu2.4 | UBUNTU-CVE-2026-40691 |
| Ubuntu:26.04:LTS | unbound | 1.24.2-1ubuntu2.4 | USN-8946-1 |
| Ubuntu:26.10 | unbound | no fix listed | UBUNTU-CVE-2026-40691 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 1.9.0 – before 1.25.2 |
Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40691.txt vendor-advisory