Skip to main content

NLnet Labs Unbound CVE-2026-55990

| EUVDEUVD-2026-47682 MEDIUM
Use of Uninitialized Variable (CWE-457)
2026-07-22 NLnet Labs GHSA-hpr4-88jh-4pvx
Information Disclosure Unbound Red Hat Suse
5.9
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H reflects two independent preconditions (DNSCrypt build flag and cert/key count mismatch); AV:N because the trigger is a single UDP packet; only availability is impacted.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:56 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').

AnalysisAI

Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.

Technical ContextAI

Unbound is a validating, recursive DNS resolver maintained by NLnet Labs (CPE: cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:*). Its optional DNSCrypt support, enabled at compile time via --enable-dnscrypt, allows the server to accept encrypted DNS queries over a dedicated UDP port. The root cause (CWE-457: Use of Uninitialized Variable) is a slot-count mismatch during configuration loading: when a dnscrypt: clause lists N cert files but only M secret-key files (N > M), Unbound allocates N slots but populates only the first M. The remaining N-M slots retain the 0xdb fill that libsodium's secure allocator writes into every fresh allocation as a debug/security measure. Iteration is then bounded by the cert count N rather than the valid key count M, so the server walks into uninitialized slots. Because libsodium's 0xdb fill is predictable and fixed, an attacker who knows the target uses DNSCrypt can craft a UDP packet whose first 8 bytes match this sentinel, causing Unbound to treat the garbage slot as a legitimate entry and crash on the resulting null/garbage pointer dereference.

RemediationAI

Consult the vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt for the patched release version; a specific fixed version number was not included in the data available for this analysis and cannot be confirmed independently. As an immediate workaround while upgrading, ensure that the number of dnscrypt-provider-cert: entries in every dnscrypt: clause exactly matches the number of dnscrypt-secret-key: entries - any surplus cert files should be removed or commented out, eliminating the uninitialized tail slots. If DNSCrypt is not operationally required, recompiling Unbound without --enable-dnscrypt or switching to a pre-built package that omits DNSCrypt support removes the attack surface entirely; this is lossless for operators not using encrypted DNS. Network-layer filtering of the dnscrypt-port to trusted client ranges can reduce exposure but does not eliminate the crash risk if any trusted client is compromised or sends malformed traffic.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-457 – Use of Uninitialized Variable

View all
CVE-2021-40418 CRITICAL POC
9.8
CVE-2021-3928 HIGH POC
7.8
CVE-2024-21502 HIGH POC
7.5
CVE-2026-22188 MEDIUM POC
6.9
CVE-2024-47540 CRITICAL
9.8
CVE-2026-6748 CRITICAL
9.8
CVE-2026-78935 CRITICAL
9.6
CVE-2026-14405 CRITICAL
9.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-55990 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy