PT-2026-42124 · Nlnet+3 · Unbound+3

Andrew Griffiths · Published 2026-05-20 · Updated 2026-06-18 · CVE-2026-32792

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.6.2 through 1.25.0

Description A denial of service issue exists when the software is compiled with DNSCrypt support using the --enable-dnscrypt flag. A specially crafted DNSCrypt query, where the decrypted plaintext consists entirely of 0x00 bytes and lacks the expected 0x80 marker, can cause an underflow in the DNSCrypt packet reading procedure. This may lead to a heap overflow—a condition where data exceeds the boundary of a memory block allocated on the heap—potentially resulting in a crash. The likelihood of a crash depends on the underlying memory allocator and memory layout.

Recommendations Update to version 1.25.1.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-166

CWE-125

Related Identifiers

CVE-2026-32792

ECHO-248E-DAC5-2836

OPENSUSE-SU-2026:10903-1

OPENSUSE-SU-2026:21083-1

RHSA-2026:20357

SUSE-SU-2026:21874-1

SUSE-SU-2026:21913-1

SUSE-SU-2026:22160-1

SUSE-SU-2026:22213-1

SUSE-SU-2026:2281-1

SUSE-SU-2026:2369-1

USN-8282-1

Affected Products

Freebsd

Linuxmint

Ubuntu

Unbound

References · 60

• https://osv.dev/vulnerability/SUSE-SU-2026:2369-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40622 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42960 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44608 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-32792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32792 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32792 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8282-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10903-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8282-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42923 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32792 · Vendor Advisory
• https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt · Vendor Advisory