CVE-2026-55990

Published: Lug 22, 2026 Last Modified: Lug 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').

457

Use of Uninitialized Variable

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Other Authorization
Potential Impacts:
Other
Applicable Platforms
Languages: C, C++, Perl, PHP, Not Language-Specific
Likelihood of Exploit: High
View CWE Details
Application

Unbound by Nlnetlabs

Product Information
Vendor Nlnetlabs
Product Unbound
Version Range Affected
From 1.7.0 (inclusive)
To 1.25.2 (exclusive)
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.t…
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt