{
  "cveId": "CVE-2026-55990",
  "url": "https://patchblox.com/security/cve/CVE-2026-55990",
  "summary": "CVE-2026-55990 is fixed in unbound on 1 platform, first by DEBIAN-CVE-2026-55990, released July 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Packet of death for a DNSCrypt misconfigured Unbound",
  "description": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0027dnscrypt:\u0027 clause lists more \u0027dnscrypt-provider-cert:\u0027 files than there are matching \u0027dnscrypt-secret-key:\u0027 files, Unbound fills only the matched prefix and leaves the tail slots at the \u00270xdb\u0027 fill that libsodium\u0027s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u00270xdb\u0027 bytes. Any unauthenticated client that sends one UDP datagram of \u2265 68 bytes whose first 8 bytes are \u00270xdb\u0027 to \u0027dnscrypt-port\u0027 will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0027--enable-dnscrypt\u0027).",
  "published": "2026-07-22T14:17:21Z",
  "severity": "Moderate",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Use of Uninitialized Variable",
  "epss": 0.00247,
  "epssPercentile": 0.1609,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55990",
  "fixes": [
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.26.1-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-55990",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-55990",
      "released": "2026-07-28T14:13:38Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "Debian 14",
      "fixedVersion": "1.25.2-1",
      "fix": "DEBIAN-CVE-2026-55990",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-55990",
      "released": "2026-07-28T14:13:38Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.25.2-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21550-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21550-1",
      "released": "2026-08-10T15:27:28Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.6",
      "fixedVersion": "1.25.2-150600.23.19.1",
      "fix": "SUSE-SU-2026:3885-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3885-1",
      "released": "2026-08-31T14:34:37Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 15.7",
      "fixedVersion": "1.25.2-150600.23.19.1",
      "fix": "SUSE-SU-2026:3885-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3885-1",
      "released": "2026-08-31T14:34:37Z"
    },
    {
      "platform": "linux",
      "product": "unbound",
      "release": "sles 16.0",
      "fixedVersion": "1.25.2-160000.1.1",
      "fix": "SUSE-SU-2026:23226-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23226-1",
      "released": "2026-08-10T15:26:22Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}