Nixpkgs security tracker
7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Packet of death for DNSCrypt over TCP
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
References
-
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40691.txt vendor-advisory
Affected products
- <1.25.2
Matching in nixpkgs
pkgs.unbound
Validating, recursive, and caching DNS resolver
pkgs.unbound-full
Validating, recursive, and caching DNS resolver
pkgs.unbound-with-systemd
Validating, recursive, and caching DNS resolver
pkgs.luaPackages.luaunbound
A binding to libunbound
pkgs.lua51Packages.luaunbound
A binding to libunbound
pkgs.lua52Packages.luaunbound
A binding to libunbound
pkgs.lua53Packages.luaunbound
A binding to libunbound
pkgs.lua54Packages.luaunbound
A binding to libunbound
pkgs.lua55Packages.luaunbound
A binding to libunbound
pkgs.luajitPackages.luaunbound
A binding to libunbound
pkgs.prometheus-unbound-exporter
Prometheus exporter for Unbound DNS resolver
pkgs.python313Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.python314Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.haskellPackages.unbound-generics
Support for programming with names and binders using GHC Generics
pkgs.haskellPackages.unbounded-delays
Unbounded thread delays and timeouts
pkgs.haskellPackages.unbound-kind-generics
Support for programming with names and binders using kind-generics
Package maintainers
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@Scrumplex Sefa Eyeoglu <contact@scrumplex.net>