{
  "cveId": "CVE-2026-32792",
  "url": "https://patchblox.com/security/cve/CVE-2026-32792",
  "summary": "CVE-2026-32792 is fixed in 5 products on 1 platform, first by libunbound8 1.24.2-1ubuntu2.1, released May 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Packet of death with DNSCrypt",
  "description": "NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (\u0027--enable-dnscrypt\u0027). A bad DNSCrypt query could underflow Unbound\u0027s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of \u00270x00\u0027 bytes and does not contain the expected \u00270x80\u0027 marker. Unbound would then start reading more bytes than necessary until it finds a non-\u00270x00\u0027 byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound\u0027s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.",
  "published": "2026-05-19T17:00:00Z",
  "severity": "Moderate",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe": "Improper Handling of Missing Special Element",
  "epss": 0.00337,
  "epssPercentile": 0.27242,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32792",
  "fixes": [
    {
      "platform": "linux",
      "product": "libunbound8",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.1-1ubuntu5.15",
      "fix": "libunbound8 1.13.1-1ubuntu5.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libunbound8-1.13.1-1ubuntu5.15",
      "released": "2026-05-27T17:38:24Z"
    },
    {
      "platform": "linux",
      "product": "libunbound8",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.19.2-1ubuntu3.8",
      "fix": "libunbound8 1.19.2-1ubuntu3.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libunbound8-1.19.2-1ubuntu3.8",
      "released": "2026-05-27T17:38:28Z"
    },
    {
      "platform": "linux",
      "product": "libunbound8",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.22.0-2ubuntu2.3",
      "fix": "libunbound8 1.22.0-2ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-libunbound8-1.22.0-2ubuntu2.3",
      "released": "2026-05-27T17:38:31Z"
    },
    {
      "platform": "linux",
      "product": "libunbound8",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.24.2-1ubuntu2.1",
      "fix": "libunbound8 1.24.2-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libunbound8-1.24.2-1ubuntu2.1",
      "released": "2026-05-19T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-unbound",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.1-1ubuntu5.15",
      "fix": "python3-unbound 1.13.1-1ubuntu5.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-unbound-1.13.1-1ubuntu5.15",
      "released": "2026-05-27T17:38:24Z"
    },
    {
      "platform": "linux",
      "product": "python3-unbound",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.19.2-1ubuntu3.8",
      "fix": "python3-unbound 1.19.2-1ubuntu3.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-unbound-1.19.2-1ubuntu3.8",
      "released": "2026-05-27T17:38:28Z"
    },
    {
      "platform": "linux",
      "product": "python3-unbound",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.22.0-2ubuntu2.3",
      "fix": "python3-unbound 1.22.0-2ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-unbound-1.22.0-2ubuntu2.3",
      "released": "2026-05-27T17:38:31Z"
    },
    {
      "platform": "linux",
      "product": "python3-unbound",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.24.2-1ubuntu2.1",
      "fix": "python3-unbound 1.24.2-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-unbound-1.24.2-1ubuntu2.1",
      "released": "2026-05-19T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.22.0-2\u002Bdeb13u3",
      "fix": "DEBIAN-CVE-2026-32792",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-32792",
      "released": "2026-05-27T17:38:13Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 14",
      "fixedVersion": "1.25.1-1",
      "fix": "DEBIAN-CVE-2026-32792",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-32792",
      "released": "2026-05-27T17:38:13Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.1-1ubuntu5.15",
      "fix": "unbound 1.13.1-1ubuntu5.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-unbound-1.13.1-1ubuntu5.15",
      "released": "2026-05-27T17:38:24Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.19.2-1ubuntu3.8",
      "fix": "unbound 1.19.2-1ubuntu3.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-unbound-1.19.2-1ubuntu3.8",
      "released": "2026-05-27T17:38:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.22.0-2ubuntu2.3",
      "fix": "unbound 1.22.0-2ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-unbound-1.22.0-2ubuntu2.3",
      "released": "2026-05-27T17:38:31Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.24.2-1ubuntu2.1",
      "fix": "unbound 1.24.2-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-unbound-1.24.2-1ubuntu2.1",
      "released": "2026-05-19T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.24.1-160000.2.1",
      "fix": "OPENSUSE-SU-2026:21083-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21083-1",
      "released": "2026-06-18T14:31:02Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 16.0",
      "fixedVersion": "1.24.1-160000.2.1",
      "fix": "SUSE-SU-2026:22160-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22160-1",
      "released": "2026-06-18T14:32:33Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.1-1ubuntu5.15",
      "fix": "unbound-anchor 1.13.1-1ubuntu5.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-unbound-anchor-1.13.1-1ubuntu5.15",
      "released": "2026-05-27T17:38:24Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.19.2-1ubuntu3.8",
      "fix": "unbound-anchor 1.19.2-1ubuntu3.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-unbound-anchor-1.19.2-1ubuntu3.8",
      "released": "2026-05-27T17:38:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.22.0-2ubuntu2.3",
      "fix": "unbound-anchor 1.22.0-2ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-unbound-anchor-1.22.0-2ubuntu2.3",
      "released": "2026-05-27T17:38:31Z"
    },
    {
      "platform": "linux",
      "product": "unbound-anchor",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.24.2-1ubuntu2.1",
      "fix": "unbound-anchor 1.24.2-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-unbound-anchor-1.24.2-1ubuntu2.1",
      "released": "2026-05-19T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "unbound-host",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.1-1ubuntu5.15",
      "fix": "unbound-host 1.13.1-1ubuntu5.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-unbound-host-1.13.1-1ubuntu5.15",
      "released": "2026-05-27T17:38:24Z"
    },
    {
      "platform": "linux",
      "product": "unbound-host",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.19.2-1ubuntu3.8",
      "fix": "unbound-host 1.19.2-1ubuntu3.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-unbound-host-1.19.2-1ubuntu3.8",
      "released": "2026-05-27T17:38:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound-host",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.22.0-2ubuntu2.3",
      "fix": "unbound-host 1.22.0-2ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-unbound-host-1.22.0-2ubuntu2.3",
      "released": "2026-05-27T17:38:31Z"
    },
    {
      "platform": "linux",
      "product": "unbound-host",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.24.2-1ubuntu2.1",
      "fix": "unbound-host 1.24.2-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-unbound-host-1.24.2-1ubuntu2.1",
      "released": "2026-05-19T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}