In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are… (CVE-2026-55990)
Description
NLnet Labs Unbound versions 1.7.0 through 1.25.1 with DNSCrypt support enabled contain a vulnerability where a misconfiguration in the 'dnscrypt:' clause causes Unbound to dereference garbage data. This occurs when more 'dnscrypt-provider-cert:' files are listed than matching 'dnscrypt-secret-key:' files, leading to a server crash upon receiving a specific UDP datagram. The issue results in a denial of service due to server termination triggered by unauthenticated client input.
CVSS v3.1
Score 5.9medium
Affected software
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/unbound?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/unbound?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/unbound?arch=source&distro=jammypkg:deb/ubuntu/unbound?arch=source&distro=noblepkg:deb/ubuntu/unbound?arch=source&distro=stonkingpkg:deb/ubuntu/unbound?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In NLnet Labs Unbound versions 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' configuration clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix slots and leaves the remaining slots filled with '0xdb' bytes from libsodium's allocator. Unbound then iterates over the number of certificate files rather than the actual slots, causing it to access these garbage-filled slots. An unauthenticated client can send a single UDP datagram of at least 68 bytes starting with eight '0xdb' bytes to the DNSCrypt port, triggering a garbage dereference that crashes the server. This vulnerability requires Unbound to be compiled with DNSCrypt support enabled ('--enable-dnscrypt').
Potential Impact
The vulnerability causes a denial of service by crashing the Unbound DNS server when triggered by a specially crafted UDP datagram from an unauthenticated client. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
No official patch or fix status is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that the 'dnscrypt:' clause configuration does not list more 'dnscrypt-provider-cert:' files than matching 'dnscrypt-secret-key:' files to avoid triggering the vulnerability. Additionally, consider disabling DNSCrypt support if not required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-55990
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5ec2cdf04f6566634fc
Added to database: 10/17/2026, 22:25:48 UTC
Last enriched: 10/18/2026, 00:43:35 UTC
Last updated: 10/18/2026, 00:43:35 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.