Denial of Service Vulnerability in NLnet Labs Unbound DNS Service

CVE-2026-32792

What is CVE-2026-32792?

NLnet Labs Unbound version 1.6.2 through 1.25.0 is affected by a denial of service vulnerability when DNSCrypt support is enabled. An incorrectly formatted DNSCrypt query can trigger an underflow which leads Unbound to read beyond the intended memory buffer, potentially causing a heap overflow. This occurs when the data received consists solely of '0x00' bytes and fails to meet the expected format, leading to a situation where the program misreads the memory allocation. While the likelihood of crashing the service is relatively low due to dependencies on memory allocator behavior and layout, it is advisable to update to Unbound version 1.25.1 or later, which includes a mitigation against this vulnerability.

References