Quick answers
- Is CVE-2026-40691 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40691 being exploited in the wild.
- How severe is CVE-2026-40691?
- High severity, with a CVSS score of 7.5, published 22 July 2026.
- Which products and versions are affected?
- NLnet Labs Unbound 1.9.0 up to and including 1.25.1.
- Is there a fix for CVE-2026-40691?
- A patch was published on 2026-07-22: Fixed in Unbound 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40691 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-40691?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in Unbound's DNSCrypt implementation when processing queries over TCP. The vulnerability occurs because the routine responsible for encrypting replies in place fails to validate the reply length against the destination buffer size on the TCP path, a check that is correctly implemented for UDP. Specifically, a reply exceeding 65,504 bytes is shifted forward by 48 bytes within a buffer sized by 'msg-buffer-size', leading to an out-of-bounds write. This requires Unbound to be compiled with '--enable-dnscrypt' and have the 'dnscrypt:' configuration enabled. An attacker can exploit this to crash the resolver process. The issue is resolved in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.9.0 up to and including 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in Unbound 1.25.2