Memory Corruption Vulnerability in NLnet Labs Unbound DNS Service
CVE-2026-55990

5.9MEDIUM

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
22 July 2026

What is CVE-2026-55990?

The vulnerability in NLnet Labs Unbound from versions 1.7.0 to 1.25.1 relates to improper handling of mismatched 'dnscrypt-provider-cert:' and 'dnscrypt-secret-key:' files. When there are more provider cert files than matching secret keys, Unbound fails to appropriately handle the excess cert files, resulting in uninitialized memory slots filled with '0xdb' bytes. An unauthenticated client can exploit this condition by sending a UDP datagram to the 'dnscrypt-port' that contains these specific garbage bytes, leading to a dereference that crashes the server. This misconfiguration can remain undetected until triggered by a suitable query, posing a risk for unprotected networks. Users must ensure that Unbound is compiled with DNSCrypt support using the '--enable-dnscrypt' flag to mitigate potential exploitation.

Affected Version(s)

Unbound 1.7.0 < 1.25.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang (Palo Alto Networks)
.