CVE-2026-55990: NLnet Labs Unbound DoS Vulnerability

CVE-2026-55990 Overview

CVE-2026-55990 is a denial-of-service vulnerability in NLnet Labs Unbound, an open-source recursive DNS resolver. The flaw affects versions 1.7.0 through 1.25.1 when compiled with DNSCrypt support (--enable-dnscrypt). When the dnscrypt: configuration lists more dnscrypt-provider-cert: files than matching dnscrypt-secret-key: files, Unbound leaves trailing certificate slots filled with libsodium's 0xdb allocator sentinel bytes. An unauthenticated attacker can send a single crafted UDP datagram to the DNSCrypt port to trigger a garbage pointer dereference, crashing the server process. The issue is tracked under [CWE-457: Use of Uninitialized Variable].

Critical Impact
A single unauthenticated UDP packet of 68 bytes or more, prefixed with eight 0xdb bytes, crashes any misconfigured Unbound DNSCrypt resolver.

Affected Products

NLnet Labs Unbound 1.7.0 through 1.25.1 (inclusive)
Deployments compiled with the --enable-dnscrypt build option
Configurations where dnscrypt-provider-cert: entries exceed matching dnscrypt-secret-key: entries

Discovery Timeline

2026-07-22 - CVE-2026-55990 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55990

Vulnerability Analysis

Unbound allocates parallel arrays for DNSCrypt provider certificates and their corresponding secret keys. When operators declare more certificate files than key files in the dnscrypt: clause, Unbound populates only the matched prefix of the allocated slots. The unmatched tail slots retain the 0xdb fill pattern that libsodium's secure allocator writes into freshly issued allocations.

The parsing loop then iterates based on the count of certificate files rather than the count of valid populated slots. When it reaches an unmatched slot, it dereferences a pointer composed of 0xdb bytes, causing a segmentation fault and terminating the resolver process.

Root Cause

The root cause is a length-tracking mismatch classified under [CWE-457]. Unbound treats uninitialized 0xdb-filled memory as a valid certificate entry because the iteration bound is derived from the wrong array length. The configuration parser does not validate that every certificate file has a matching secret key file before allowing the daemon to start.

Attack Vector

Exploitation requires no authentication and no prior state. An attacker sends one UDP datagram of at least 68 bytes to the configured dnscrypt-port, with the first eight bytes set to 0xdb. The datagram matches the sentinel pattern Unbound reads from the uninitialized slot, forcing the daemon down the vulnerable code path. The result is a reliable crash of the resolver, denying DNS resolution to all downstream clients until the process restarts.

The misconfiguration is silent. Operators receive no warning at startup, and the service runs normally for legitimate queries until an attacker sends the trigger packet. See the NLnet Labs CVE-2026-55990 Advisory for full technical details.

Detection Methods for CVE-2026-55990

Indicators of Compromise

Unbound process termination or restart events correlated with inbound UDP traffic on the DNSCrypt port
Inbound UDP datagrams of 68 bytes or larger whose first eight bytes are 0xdb 0xdb 0xdb 0xdb 0xdb 0xdb 0xdb 0xdb
Core dumps or crash logs referencing DNSCrypt certificate handling code paths
Unbound configurations where the number of dnscrypt-provider-cert: entries exceeds dnscrypt-secret-key: entries

Detection Strategies

Audit all Unbound unbound.conf files for balanced dnscrypt-provider-cert: and dnscrypt-secret-key: declarations
Deploy network monitoring rules to alert on UDP payloads to DNSCrypt ports beginning with a run of 0xdb bytes
Track daemon uptime and process crash counters for Unbound instances exposing DNSCrypt

Monitoring Recommendations

Forward Unbound systemd or process supervisor logs to a centralized log platform and alert on abnormal restart frequency
Correlate DNS service availability with firewall telemetry on the DNSCrypt listener
Monitor Unbound version inventory to identify hosts still running 1.7.0 through 1.25.1

How to Mitigate CVE-2026-55990

Immediate Actions Required

Inventory all Unbound deployments and identify installations built with --enable-dnscrypt
Review each unbound.conf and ensure every dnscrypt-provider-cert: entry has a matching dnscrypt-secret-key: entry
Upgrade to a fixed release published by NLnet Labs above version 1.25.1
Restrict inbound access to the DNSCrypt port to trusted networks where feasible

Patch Information

NLnet Labs has published a security advisory at NLnet Labs CVE-2026-55990 Advisory. Operators should upgrade to the fixed Unbound release referenced in that advisory and rebuild any packages compiled from source with DNSCrypt support enabled.

Workarounds

Correct the configuration by removing surplus dnscrypt-provider-cert: entries so the certificate and secret-key lists have equal length
Rebuild Unbound without --enable-dnscrypt if DNSCrypt is not required in your environment
Filter inbound UDP traffic to the DNSCrypt port at the network edge, blocking datagrams whose first eight bytes are 0xdb

bash

# Verify certificate and key counts match in unbound.conf
grep -c '^\s*dnscrypt-provider-cert:' /etc/unbound/unbound.conf
grep -c '^\s*dnscrypt-secret-key:' /etc/unbound/unbound.conf

# Validate configuration and restart service after correction
unbound-checkconf /etc/unbound/unbound.conf
systemctl restart unbound