Skip to content
Fencer Vulns
medium 5.3

CVE-2026-32792 json

Packet of death with DNSCrypt

published 2026-05-20 5 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-31077

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.

Patch / fix

  • NLnet Labs Unbound 1.25.1
  • unbound Debian 13 1.22.0-2+deb13u3
  • unbound Debian 14 1.25.1-1

debian advisories DEBIAN-CVE-2026-32792

  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.15
  • unbound Ubuntu 24.04 LTS 1.19.2-1ubuntu3.8
  • unbound Ubuntu 25.10 1.22.0-2ubuntu2.3
  • unbound Ubuntu 26.04 LTS 1.24.2-1ubuntu2.1

ubuntu advisories UBUNTU-CVE-2026-32792

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound hummingbird 1 1.25.1-1.hum1
  • unbound-libs hummingbird 1 1.25.1-1.hum1
  • unbound-munin hummingbird 1 1.25.1-1.hum1
  • unbound-utils hummingbird 1 1.25.1-1.hum1
  • unbound-anchor hummingbird 1 1.25.1-1.hum1
  • unbound-dracut hummingbird 1 1.25.1-1.hum1
  • python3-unbound hummingbird 1 1.25.1-1.hum1

red hat advisories RHSA-2026:20357

  • unbound SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.24.1-160000.2.1
  • unbound SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 1.20.0-150100.10.25.1

suse advisories SUSE-SU-2026:22160-1SUSE-SU-2026:22213-1SUSE-SU-2026:2369-1

  • unbound openSUSE Leap 16.0 1.24.1-160000.2.1
  • unbound openSUSE Tumbleweed 1.25.1-1.1

opensuse advisories openSUSE-SU-2026:21083-1openSUSE-SU-2026:10903-1

  • unbound Azure Linux 3.0 1.25.1-1

azure linux advisories AZL-87015

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32792 updated cvss 5.9

unbound: Packet of death with DNSCrypt

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 8 unbound, unbound-libs, python3-unbound
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 10 unbound
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images unbound 1.25.1-1.hum1, unbound-libs 1.25.1-1.hum1, unbound-munin 1.25.1-1.hum1, unbound-utils 1.25.1-1.hum1, unbound-anchor 1.25.1-1.hum1, unbound-dracut 1.25.1-1.hum1, +1 more
    fixed: vendor fix RHSA-2026:20357
  • Red Hat Enterprise Linux 9 unbound, unbound-libs, unbound-dracut, python3-unbound
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 4.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CNA 4.0 4.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • NLnet Labs Unbound

Classification

Weakness
  • CWE-166 Improper Handling of Missing Special Element
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.