VulnSocial

CVE-2026-40691Patch(nlnetlabs / unbound)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nlnetlabs unbound systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.

nlnetlabs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-122CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • unbound

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-22); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
nlnetlabs
Products
unbound

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-22: 1Mentions · 2026-07-28: 1Mentions · 2026-08-04: 1Patch / Workaround · 2026-07-28: 1Patch / Workaround · 2026-08-04: 1Technical Details · 2026-07-22: 1Technical Details · 2026-07-28: 1Technical Details · 2026-08-04: 107-2207-2808-04
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-221
General1
2026-07-281
Patch1
2026-08-041
Patch1
Full discourse3 posts
  • Yasuhiro Morishita@OrangeMorishita
    General

    CVE-2026-14586 Medium DoS CVE-2026-32665 High DoS CVE-2026-40691 High DoS CVE-2026-41637 Low DoS CVE-2026-42955 Low CVE-2026-40622（幽霊ドメイン名）の追加修正 CVE-2026-44621 Medium DoS CVE-2026-44687 Low DoS（存在するドメイン名を存在しないと誤認させる） CVE-2026-44690 High キャッシュポイズニング CVE-2026-46582 Low キャッシュポイズニング CVE-2026-50045 Medium 外部へのDoS CVE-2026-50046 Medium DoS CVE-2026-50243 Medium DNSSEC検証のバイパス CVE-2026-50248 Medium DNSSEC Bogusでもゾーン転送の接続先にしてしまう CVE-2026-50251 Medium 外部からの意図的なキャッシュクリアによるDoS CVE-2026-50252 Medium UDPソースポートを外部から推測可能（キャッシュポイズニング） CVE-2026-52863 Medium DoS CVE-2026-54478 Low DNSクッキーの無力化 CVE-2026-55708 Low ローカルな名前を外部に問い合わせてしまう（情報流出） CVE-2026-55717 Medium DoS CVE-2026-55973 High DoS CVE-2026-55990 Medium DoS CVE-2026-55991 Medium DoS CVE-2026-56416 Medium DoS CVE-2026-56444 Medium DoS

    Post summary

    This entry enumerates multiple CVE identifiers with their severity ratings and general vulnerability categories, but lacks specific details on exploitation, mitigation, or proofs of concept.

    10040503
    4.6K followersView on X
  • CyStack@CyStackSecurity
    Patch

    CVE-2026-40691: Heap overflow in Unbound, one of the most widely deployed open-source DNS resolvers with 4.7k GitHub stars. Send one DNSCrypt query over TCP. Reply overflows the heap. Resolver crashes. Users behind it lose DNS. Patched in v1.25.2. Found by a CyStack researcher. For more vulnerabilities, visit https://cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #Unbound #DNS #DNSCrypt #DoS #EnterpriseSecurity #InfoSec #CVE

    Post summary

    The heap overflow flaw in Unbound allows a DoS via a single DNSCrypt TCP query; it has been fixed in version 1.25.2 and was discovered by a CyStack researcher.

    01020102
    3.7K followersView on X
  • Open Source Security mailing list@oss_security
    Patch

    Unbound 1.25.2 fixes many CVEs https://www.openwall.com/lists/oss-security/2026/07/22/7 4 "severity: HIGH" CVE-2026-32665: Remote DNS-over-QUIC DoS CVE-2026-40691: Packet of death for DNSCrypt over TCP CVE-2026-44690: Cross-zone wildcard cache poisoning CVE-2026-55973: Stack buffer overflow + many MEDIUM and LOW

    Post summary

    The message announces the release of Unbound 1.25.2 as a patch that fixes multiple high‑severity CVEs, listing affected vulnerabilities but providing no exploit or active exploitation details.

    00030421
    4.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnlnetlabsunbound---

Explore more

Back to dashboardnlnetlabs CVEsunbound vulnerabilities