CVE-2026-40691
Publication date 22 July 2026
Last updated 21 October 2026
Ubuntu priority
Description
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| unbound | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Fixed in 1.24.2-1ubuntu2.4
|
|
| 24.04 LTS noble |
Fixed in 1.19.2-1ubuntu3.12
|
|
| 22.04 LTS jammy |
Fixed in 1.13.1-1ubuntu5.17
|
|
| 20.04 LTS focal |
Fixed in 1.9.4-2ubuntu1.11+esm3
|
|
| 18.04 LTS bionic |
Fixed in 1.6.7-1ubuntu2.6+esm6
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8946-1
- Unbound vulnerabilities
- 21 October 2026