CVE Explorer

CVE-2026-40691

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:62cb0e6b5c176fb04f7000034b7fbfc55e4e06007db947647d164a346d97fd19

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/problemTypes/0/descriptions/1

{"cweId":"CWE-122","description":"CWE-122: Heap-based Buffer Overflow","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Unbound","vendor":"NLnet Labs","versions":[{"lessThan":"1.25.2","status":"affected","version":"1.9.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/problemTypes/0/descriptions/1

{"cweId":"CWE-122","description":"CWE-122: Heap-based Buffer Overflow","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40691.txt"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8212a7b4cca51d44c5b12d24f25d7bcf16f50acb6e714cca9671820017330235 · sha256:605747ab87b4d326… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer