Executive brief
NLnet Labs Unbound, a widely used DNS resolver, contains a flaw in its DNSCrypt implementation that can lead to a service crash. If the software is configured with a specific mismatch in its security certificates and keys, a remote attacker can send a specially crafted network packet to shut down the server. This results in a denial-of-service, preventing users from resolving domain names and potentially disrupting internet connectivity for affected networks.
Technical details
A vulnerability exists in Unbound's DNSCrypt implementation (CWE-457) when the number of 'dnscrypt-provider-cert' files exceeds the number of 'dnscrypt-secret-key' files in the configuration. In this scenario, Unbound fails to properly initialize the tail slots of the certificate array, leaving them filled with '0xdb' bytes from the libsodium allocator. An unauthenticated remote attacker can trigger a garbage pointer dereference and subsequent daemon crash by sending a UDP datagram of at least 68 bytes starting with the '0xdb' sequence to the DNSCrypt port. This issue affects Unbound versions 1.7.0 through 1.25.1 when compiled with '--enable-dnscrypt'. The vulnerability is addressed in version 1.25.2, which introduces configuration validation and proper array initialization.
Affected products
- NLnet Labs Unbound 1.7.0 to 1.25.1
Timeline
- 2026-07-22: advisory
- 2026-07-22: disclosed
- 2026-07-22: patched