NLnet Labs Unbound EUVD-2026-31077

The primary remediation is upgrading to Unbound 1.25.1, which contains a vendor-released patch that bounds the DNSCrypt buffer read to the declared buffer space, eliminating the out-of-bounds condition. The advisory is at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt. For operators who cannot immediately upgrade, the most effective compensating control is to recompile Unbound without the '--enable-dnscrypt' flag if DNSCrypt is not operationally required - this entirely removes the vulnerable code path with no DNS resolution impact, though it eliminates DNSCrypt-encrypted client support. If DNSCrypt is required and patching is deferred, restricting access to the DNSCrypt listener port (typically UDP/443 or a custom port) to known trusted client IP ranges via firewall rules reduces the attack surface at the cost of blocking legitimate DNSCrypt clients from untrusted networks. Network-layer rate limiting of DNSCrypt traffic is a weaker mitigation that does not prevent the vulnerability but may reduce crash probability under sustained attack.