CVE-2026-55990

{"id": "CVE-2026-55990", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55990", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:04:13.654490Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.7.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:21.810", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt", "tags": ["Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-457"}]}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of \u2265 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt')."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.7.0 hasta la versi\u00f3n 1.25.1 inclusive, cuando la cl\u00e1usula \u2019dnscrypt:\u2019 enumera m\u00e1s archivos \u2019dnscrypt-provider-cert:\u2019 de los que hay archivos \u2019dnscrypt-secret-key:\u2019 coincidentes, Unbound solo llena el prefijo coincidente y deja las ranuras finales con el relleno \u20190xdb\u2019 que el asignador de libsodium escribe en cada asignaci\u00f3n. Unbound entonces iterar\u00eda sobre el n\u00famero de archivos de certificado, no sobre las ranuras reales, por lo que accede a una ranura con datos basura llenos de bytes \u20190xdb\u2019. Cualquier cliente no autenticado que env\u00ede un datagrama UDP de ? 68 bytes cuyos primeros 8 bytes sean \u20190xdb\u2019 al puerto \u2019dnscrypt\u2019 utilizar\u00e1 esa entrada basura, lo que lleva a una desreferenciaci\u00f3n de basura que detiene el servidor. Esta es una configuraci\u00f3n defectuosa silenciosa que pasa desapercibida hasta que se activa con la consulta de cliente correcta. Unbound necesita ser compilado con soporte para DNSCrypt (\u2019--enable-dnscrypt\u2019)."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2331CF5-0B7D-4505-A5A0-408593040279", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}