CVE-2026-40691

Name of the Vulnerable Software and Affected Versions Unbound versions 1.9.0 through 1.25.1

Description A heap-based buffer overflow occurs when a DNSCrypt query is received over TCP. The routine responsible for encrypting the reply in place does not bound the reply length against the destination buffer size, failing to apply the size clamp used in the UDP path. Consequently, a reply exceeding 65504 bytes is shifted forward by 48 bytes within a buffer of capacity msg-buffer-size, resulting in a write operation past the end of the heap allocation. This can be triggered by a single malicious encrypted query, causing the resolver to crash and leading to a denial of service. This issue requires the software to be compiled with DNSCrypt support via --enable-dnscrypt and the dnscrypt: clause to be configured and enabled for listening interfaces.

Recommendations Update Unbound to a version later than 1.25.1. As a temporary mitigation, disable the dnscrypt: clause on listening interfaces or avoid compiling the software with the --enable-dnscrypt option.