UBUNTU-CVE-2026-40691: High severity ubuntu/unbound vulnerability

Q: Which Unbound deployments are exposed?

Only deployments running an affected Unbound version with DNSCrypt compiled in using --enable-dnscrypt and with a dnscrypt: clause configured and enabled on listening interfaces are exposed. Systems without DNSCrypt support or without DNSCrypt enabled for listeners are not affected by this issue.

Q: What does an attacker need to exploit this?

An attacker needs network access to send a malicious encrypted DNSCrypt query over TCP to an affected listening interface. No authentication or user interaction is required.

Q: What is the impact of successful exploitation?

A single malicious query can write past a heap allocation and crash the resolver, causing denial of service. The provided information does not describe confidentiality or integrity impact.

Q: How can I determine whether my resolver is affected?

Check whether the installed Unbound version is from 1.9.0 through 1.25.1 inclusive, whether it was built with --enable-dnscrypt, and whether its configuration contains an enabled dnscrypt: clause for any listening interface. TCP DNSCrypt exposure is required for the vulnerable path.

Published Jul 22, 2026

Updated

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.

Affected Software

6 affected componentsFixes available

ubuntu/unbound<1.6.7-1ubuntu2.6+esm6

1.6.7-1ubuntu2.6+esm6

ubuntu/unbound<1.9.4-2ubuntu1.11+esm3

1.9.4-2ubuntu1.11+esm3

ubuntu/unbound<1.13.1-1ubuntu5.17

1.13.1-1ubuntu5.17

ubuntu/unbound<1.19.2-1ubuntu3.12

1.19.2-1ubuntu3.12

ubuntu/unbound<1.25.1-1ubuntu3.1

1.25.1-1ubuntu3.1

ubuntu/unbound<1.24.2-1ubuntu2.4

1.24.2-1ubuntu2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.6.7-1ubuntu2.6+esm6
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.9.4-2ubuntu1.11+esm3
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.13.1-1ubuntu5.17
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.19.2-1ubuntu3.12
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.25.1-1ubuntu3.1
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.24.2-1ubuntu2.4

Event History

Jul 22, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Unbound deployments are exposed?

Only deployments running an affected Unbound version with DNSCrypt compiled in using --enable-dnscrypt and with a dnscrypt: clause configured and enabled on listening interfaces are exposed. Systems without DNSCrypt support or without DNSCrypt enabled for listeners are not affected by this issue.

What does an attacker need to exploit this?

An attacker needs network access to send a malicious encrypted DNSCrypt query over TCP to an affected listening interface. No authentication or user interaction is required.

What is the impact of successful exploitation?

A single malicious query can write past a heap allocation and crash the resolver, causing denial of service. The provided information does not describe confidentiality or integrity impact.

How can I determine whether my resolver is affected?

Check whether the installed Unbound version is from 1.9.0 through 1.25.1 inclusive, whether it was built with --enable-dnscrypt, and whether its configuration contains an enabled dnscrypt: clause for any listening interface. TCP DNSCrypt exposure is required for the vulnerable path.

UBUNTU-CVE-2026-40691: High severity ubuntu/unbound vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Unbound deployments are exposed?

What does an attacker need to exploit this?

What is the impact of successful exploitation?

How can I determine whether my resolver is affected?

Company

Resources

Contact

Frequently Asked Questions

Which Unbound deployments are exposed?

What does an attacker need to exploit this?

What is the impact of successful exploitation?

How can I determine whether my resolver is affected?