CVE-2026-40691 Packet of death for DNSCrypt over TCP
A remote attacker can crash the Unbound DNS resolver by sending a malicious DNSCrypt TCP query, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40691?
CVE-2026-40691 is a high-severity memory corruption vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.
Which versions are affected by CVE-2026-40691?
It affects 1 product.
Products include Nlnetlabs Unbound.
How do I fix CVE-2026-40691?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40691 being exploited?
There is no known exploitation of CVE-2026-40691 in the wild and no public exploit code.
Other vulnerabilities in Nlnetlabs Unbound
- CVE-2026-81642 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
- CVE-2026-42944 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42959 Crash during DNSSEC validation of malicious content
- CVE-2026-82717 CNAME synthesis could lead to heap corruption
Sources
Also known as AZL-92949, DEBIAN-CVE-2026-40691, ECHO-c9bd-ba81-0bae, GHSA-vxvj-6rhp-3pqq, ROOT-OS-DEBIAN-11-CVE-2026-40691, ROOT-OS-DEBIAN-12-CVE-2026-40691 and 1 more.