CVE-2026-40691: Unbound DNSCrypt DoS Vulnerability

CVE-2026-40691 Overview

CVE-2026-40691 is a heap buffer overflow [CWE-122] in the Unbound recursive DNS resolver from NLnet Labs. The flaw affects Unbound versions 1.9.0 through 1.25.1 when compiled with DNSCrypt support (--enable-dnscrypt) and configured with an active dnscrypt: clause. When a DNSCrypt query arrives over TCP, the in-place reply encryption routine fails to bound the reply length against the destination buffer. A single malicious encrypted query crashes the resolver, producing a denial of service against affected DNS infrastructure.

Critical Impact
A remote attacker can crash Unbound resolvers with one crafted DNSCrypt-over-TCP query, disrupting name resolution for all downstream clients.

Affected Products

Unbound 1.9.0 through 1.25.1 compiled with --enable-dnscrypt
Unbound deployments with an active dnscrypt: clause on listening interfaces
DNS resolver infrastructure exposing DNSCrypt over TCP to untrusted networks

Discovery Timeline

2026-07-22 - CVE-2026-40691 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-40691

Vulnerability Analysis

Unbound supports DNSCrypt to authenticate and encrypt DNS traffic between clients and the resolver. When a DNSCrypt query is received, Unbound encrypts the reply in place inside a buffer sized by the msg-buffer-size configuration option. The encryption routine prepends a 48-byte DNSCrypt header, shifting the plaintext reply forward inside the same allocation.

The UDP receive path applies a size clamp that limits the reply length before this shift occurs. The TCP receive path omits that clamp. When a reply exceeds 65504 bytes on the TCP path, the 48-byte forward shift pushes data past the end of the heap allocation, corrupting adjacent heap memory and crashing the resolver process.

Root Cause

The root cause is missing input validation on the TCP DNSCrypt path. The size clamp that protects the UDP encryption routine was never mirrored on the TCP handler, leaving the reply length unbounded relative to the destination buffer capacity. The condition is classified as a heap-based buffer overflow [CWE-122].

Attack Vector

Exploitation requires network access to a Unbound listener with DNSCrypt enabled over TCP. No authentication or user interaction is required. A single crafted encrypted query is sufficient to trigger the out-of-bounds write and terminate the resolver process, denying DNS service to all clients relying on that instance. See the NLnet Labs advisory for CVE-2026-40691 for the vendor's technical description.

Detection Methods for CVE-2026-40691

Indicators of Compromise

Unexpected Unbound process crashes or restarts recorded in systemd, service manager, or watchdog logs
Abnormally large inbound DNSCrypt queries on TCP port 443 or the configured DNSCrypt port
Segmentation faults or heap corruption messages referencing Unbound in kernel or dmesg output

Detection Strategies

Monitor Unbound service uptime and restart counters to identify repeated crashes consistent with exploitation attempts
Inspect DNSCrypt TCP session sizes and alert on payloads approaching or exceeding 65504 bytes
Correlate resolver crashes with source IP addresses of recent DNSCrypt TCP connections to identify likely attackers

Monitoring Recommendations

Enable core dump collection for Unbound and forward crash telemetry to a centralized log platform
Track msg-buffer-size utilization and TCP DNSCrypt query volumes as baseline metrics
Alert on sudden drops in successful DNS query rates that coincide with resolver process termination

How to Mitigate CVE-2026-40691

Immediate Actions Required

Identify all Unbound instances compiled with --enable-dnscrypt and running versions 1.9.0 through 1.25.1
Restrict inbound DNSCrypt TCP access to trusted client networks using host or network firewall rules
Upgrade to the fixed Unbound release referenced in the NLnet Labs advisory as soon as it is available in your distribution

Patch Information

NLnet Labs has published details for CVE-2026-40691 in the vendor advisory. Administrators should upgrade Unbound to a release later than 1.25.1 that includes the size clamp fix on the TCP DNSCrypt path. Rebuild from source or update through the operating system package manager once the patched version is available.

Workarounds

Disable DNSCrypt by removing or commenting out the dnscrypt: clause in unbound.conf if the feature is not required
Rebuild Unbound without the --enable-dnscrypt compile flag when DNSCrypt support is not needed
Block TCP transport for DNSCrypt at the network edge while retaining UDP if operational needs allow

bash

# Example: disable the DNSCrypt clause in unbound.conf
# dnscrypt:
#     dnscrypt-enable: yes
#     dnscrypt-port: 443
#     dnscrypt-provider: 2.dnscrypt-cert.example.com
#     dnscrypt-secret-key: /etc/unbound/dnscrypt/secret.key
#     dnscrypt-provider-cert: /etc/unbound/dnscrypt/cert

# Verify Unbound configuration and restart the service
unbound-checkconf /etc/unbound/unbound.conf
systemctl restart unbound