The CVE number for this vulnerability is CVE-2026-40691.


== Summary
A denial of service vulnerability has been discovered in Unbound when compiled
with DNSCrypt support ('--enable-dnscrypt').
A single bad DNSCrypt query over TCP could underflow Unbound's DNSCrypt packet
reading procedure that may lead to heap overflow and eventual server crash and
denial of service.

Unbound 1.25.2 includes fixes to select the proper buffer TCP buffer for
DNSCrypt, to properly check against the buffer's capacity and to clear the
buffer before writing the dnscrypt contents otherwise UDP queries can hit
assertions.


== Affected products
Unbound 1.9.0 up to and including version 1.25.1.


== Description
When a DNSCrypt query is received over TCP, the routine that encrypts the
reply in place fails to bound the reply length against the destination buffer
size.
The size clamp that protects the UDP path is not applied on the TCP path,
so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a
buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap
allocation.
A single malicious encrypted query crashes the resolver and lead to denial of
service.

This vulnerability needs Unbound to be compiled with DNSCrypt support
('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled
for the listening interfaces.

Unbound 1.25.2 includes fixes to select the proper buffer TCP buffer for
DNSCrypt, to properly check against the buffer's capacity and to clear the
buffer before writing the dnscrypt contents otherwise UDP queries can hit
assertions.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-40691_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-40691_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-40691.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, also Trung
Nguyen (@everping) of CyStack for discovering and responsibly disclosing the
vulnerability.