CVE-2026-32792: Nlnetlabs Unbound DOS Vulnerability

CVE-2026-32792 Overview

CVE-2026-32792 is an out-of-bounds read vulnerability [CWE-125] in NLnet Labs Unbound, a widely deployed recursive, validating, and caching DNS resolver. The flaw affects Unbound versions 1.6.2 through 1.25.0 when compiled with DNSCrypt support using the --enable-dnscrypt build flag. A malformed DNSCrypt query can cause an integer underflow in the packet reading procedure, leading to a potential heap overflow read and process crash. NLnet Labs released 1.25.1 with a fix that bounds reads within the allocated buffer space. The vulnerability is remotely exploitable without authentication, but successful exploitation depends on the underlying memory allocator and runtime memory layout.

Critical Impact
A single malformed DNSCrypt query can crash Unbound, disrupting DNS resolution for all downstream clients relying on the resolver.

Affected Products

NLnet Labs Unbound 1.6.2 through 1.25.0 (compiled with --enable-dnscrypt)
Unbound builds without DNSCrypt support are not affected
Fixed in NLnet Labs Unbound 1.25.1

Discovery Timeline

2026-05-20 - CVE-2026-32792 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-32792

Vulnerability Analysis

Unbound's DNSCrypt implementation decrypts incoming queries and then parses the resulting plaintext to locate a 0x80 marker byte that delimits the DNS payload. The parser scans past leading 0x00 padding bytes until it encounters a non-zero byte, which it expects to be 0x80.

When an attacker submits a DNSCrypt query whose decrypted plaintext consists entirely of 0x00 bytes, the scan never finds the terminating marker. The reading procedure continues beyond the bounds of the decrypted buffer, producing an out-of-bounds read. Depending on heap layout, this can escalate into a heap overflow read and crash the resolver process.

If the read does not cross into unmapped memory, Unbound's subsequent packet validation logic rejects the malformed query without further effect. The exploit primitive is therefore probabilistic and tied to allocator behavior rather than deterministic. The impact is denial of service rather than memory disclosure or code execution.

Root Cause

The root cause is a missing bounds check on the DNSCrypt plaintext scanning loop. The procedure trusts that the decrypted plaintext contains a 0x80 marker and does not verify that the search index remains within the buffer length. This results in an integer underflow of the remaining-bytes counter and a read past the buffer end.

Attack Vector

An unauthenticated remote attacker sends a single crafted DNSCrypt query to a vulnerable Unbound instance over the network. The query must produce a decrypted plaintext consisting entirely of 0x00 bytes, with no 0x80 separator. Only resolvers built with DNSCrypt support and exposed on a network where the attacker can reach the DNSCrypt listener are exploitable. No user interaction or prior authentication is required.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. Detailed technical context is available in the NLnet Labs Vulnerability Advisory.

Detection Methods for CVE-2026-32792

Indicators of Compromise

Unexpected Unbound process crashes or restarts on resolvers with --enable-dnscrypt enabled
Core dumps from the unbound binary referencing DNSCrypt parsing functions
Gaps in DNS query logs followed by resolver service restart events
Inbound DNSCrypt traffic from unfamiliar source addresses preceding a crash

Detection Strategies

Monitor Unbound logs for abnormal termination signals and watchdog-driven restarts on DNSCrypt-enabled resolvers
Correlate process crash telemetry with inbound packets on the DNSCrypt UDP/TCP listener
Inspect packet captures for DNSCrypt queries whose decrypted payload size is small but contains no 0x80 marker
Track Unbound version inventory across infrastructure and flag any host running 1.6.2 through 1.25.0 with DNSCrypt compiled in

Monitoring Recommendations

Enable verbose Unbound logging and forward unbound syslog output to a central log platform for crash analysis
Alert on repeated service restarts of the resolver within short time windows
Baseline normal DNSCrypt query volumes and alert on sudden spikes from single source addresses

How to Mitigate CVE-2026-32792

Immediate Actions Required

Upgrade Unbound to version 1.25.1 or later on all resolvers compiled with DNSCrypt support
Inventory build configurations to identify which deployments use --enable-dnscrypt
Restrict network exposure of DNSCrypt listeners to trusted clients where operationally feasible
Verify automated service supervisors are configured to restart Unbound after a crash to limit DNS outage duration

Patch Information

NLnet Labs released Unbound 1.25.1, which bounds the read operation within the decrypted DNSCrypt buffer and rejects malformed plaintext that lacks the 0x80 marker. Operators should download the patched release from NLnet Labs and rebuild or update through their distribution. Full advisory details are published at the NLnet Labs Vulnerability Advisory.

Workarounds

Rebuild Unbound from source without the --enable-dnscrypt configure flag if DNSCrypt is not required
Disable the DNSCrypt listener in unbound.conf by removing or commenting out dnscrypt-enable: yes and associated port directives
Place upstream packet filtering in front of the resolver to drop DNSCrypt traffic from untrusted networks until patching completes

bash

# Disable DNSCrypt in unbound.conf as a temporary workaround
# /etc/unbound/unbound.conf
dnscrypt:
    dnscrypt-enable: no

# Reload Unbound to apply the change
sudo unbound-control reload

# Verify the running version after upgrading to 1.25.1
unbound -V | head -n 1