Executive brief
NLnet Labs Unbound, a widely used DNS resolver that translates domain names into IP addresses, contains a vulnerability in its DNSCrypt feature. An attacker can send a specially crafted network request that may cause the service to crash, leading to a denial of service. This issue only affects systems where DNSCrypt support was manually enabled during installation.
Technical details
A heap-based buffer overflow vulnerability exists in Unbound's DNSCrypt packet reading procedure. The flaw is triggered when a decrypted DNSCrypt plaintext packet consists entirely of 0x00 bytes and lacks the mandatory 0x80 marker, causing the parser to underflow and continue reading past the intended buffer until a non-zero byte is encountered. This out-of-bounds read can lead to a heap overflow and subsequent service crash depending on the memory layout and allocator in use. The vulnerability is reachable over the network without authentication but requires Unbound to be compiled with the '--enable-dnscrypt' flag. A fix is available in version 1.25.1.
Affected products
- NLnet Labs Unbound 1.6.2 through 1.25.0
Timeline
- 2026-05-20: advisory: NLnet Labs released advisory and patch details.
- 2026-05-20: disclosed