CVE-2026-32792 Packet of death with DNSCrypt
A malicious DNSCrypt query can cause a heap overflow and crash in Unbound when DNSCrypt support is enabled, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32792?
CVE-2026-32792 is a medium-severity memory corruption vulnerability in Nlnetlabs Unbound, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.
Which versions are affected by CVE-2026-32792?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-32792?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-32792 being exploited?
There is no known exploitation of CVE-2026-32792 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
Sources
Also known as AZL-87015, DEBIAN-CVE-2026-32792, ECHO-248e-dac5-2836, GHSA-8v34-57vr-p4cp, UBUNTU-CVE-2026-32792.