CVE-2026-55990

{
  "id": "CVE-2026-55990",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:21.810",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt')."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound 1.7.0 hasta la versión 1.25.1 inclusive, cuando la cláusula ’dnscrypt:’ enumera más archivos ’dnscrypt-provider-cert:’ de los que hay archivos ’dnscrypt-secret-key:’ coincidentes, Unbound solo llena el prefijo coincidente y deja las ranuras finales con el relleno ’0xdb’ que el asignador de libsodium escribe en cada asignación. Unbound entonces iteraría sobre el número de archivos de certificado, no sobre las ranuras reales, por lo que accede a una ranura con datos basura llenos de bytes ’0xdb’. Cualquier cliente no autenticado que envíe un datagrama UDP de ? 68 bytes cuyos primeros 8 bytes sean ’0xdb’ al puerto ’dnscrypt’ utilizará esa entrada basura, lo que lleva a una desreferenciación de basura que detiene el servidor. Esta es una configuración defectuosa silenciosa que pasa desapercibida hasta que se activa con la consulta de cliente correcta. Unbound necesita ser compilado con soporte para DNSCrypt (’--enable-dnscrypt’)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.7.0",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:04:13.654490Z",
          "id": "CVE-2026-55990",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-457"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.7.0",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "E2331CF5-0B7D-4505-A5A0-408593040279"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}