CVE-2026-55990— Packet of death for a DNSCrypt misconfigured Unbound
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | Unbound | 1.7.0< 1.25.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55990
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Packet of death for a DNSCrypt misconfigured Unbound
Source: CVE Program / CVE List V5
Vulnerability Description
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用未经初始化的变量
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs Unbound 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs Unbound是荷兰NLnet Labs组织的域名系统解析服务器。 NLnet Labs Unbound 1.7.0版本至1.25.1版本存在异常处理不当漏洞，该漏洞源于在dnscrypt配置文件中，证书文件数量多于密钥文件时，导致末尾槽位被填充垃圾数据，任何未经身份验证的客户端发送特定UDP数据包后，会触发该垃圾条目并导致服务器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | Unbound | 1.7.0 ~ 1.25.2 | - |
II. Public POCs for CVE-2026-55990
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55990
请登录查看更多情报信息。
News Coverage for CVE-2026-55990 (1)
Same Patch Batch · NLnet Labs · 2026-07-22 · 24 CVEs total
| CVE-2026-55973 | 7.5 HIGH | 'dns-error-reporting: yes' leads to stack buffer overflow |
| CVE-2026-44690 | 7.5 HIGH | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation |
| CVE-2026-32665 | 7.5 HIGH | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass |
| CVE-2026-40691 | 7.5 HIGH | Packet of death for DNSCrypt over TCP |
| CVE-2026-50248 | 6.5 MEDIUM | BOGUS configured primary hostname accepted for XFR in auth/rpz zones |
| CVE-2026-50046 | 5.9 MEDIUM | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out |
| CVE-2026-55717 | 5.9 MEDIUM | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash |
| CVE-2026-55991 | 5.9 MEDIUM | Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 |
| CVE-2026-56444 | 5.9 MEDIUM | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout |
| CVE-2026-44621 | 5.9 MEDIUM | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abr |
| CVE-2026-52863 | 5.9 MEDIUM | Memory corruption could lead to crash and denial of service |
| CVE-2026-14586 | 5.9 MEDIUM | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments |
| CVE-2026-50251 | 5.3 MEDIUM | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush |
| CVE-2026-50045 | 5.3 MEDIUM | 'max-global-quota' reset by DNSSEC validation restarts |
| CVE-2026-56416 | 4.8 MEDIUM | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name |
| CVE-2026-42955 | 3.7 LOW | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-tim |
| CVE-2026-54478 | 3.7 LOW | DNS Cookie bypass when combined with proxy-protocol use |
| CVE-2026-44687 | 3.7 LOW | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legi |
| CVE-2026-46582 | 3.7 LOW | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply |
| CVE-2026-41637 | 3.7 LOW | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUI |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Unbound
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow - CVE-2026-55717
'serve-expired-client-timeout' and 'response-ip' CNAME redir
Same vendor: NLnet Labs
- CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and - CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R - CVE-2026-55991
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in - CVE-2026-55973
'dns-error-reporting: yes' leads to stack buffer overflow - CVE-2026-55717
'serve-expired-client-timeout' and 'response-ip' CNAME redir
V. Comments for CVE-2026-55990
No comments yet