https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:24:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-55990 <p><strong>Affected:</strong> NLnet Labs Unbound</p> <p>In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the &#39;dnscrypt:&#39; clause lists more &#39;dnscrypt-provider-cert:&#39; files than there are matching &#39;dnscrypt-secret-key:&#39; files, Unbound fills only the matched prefix and leaves the tail slots at the &#39;0xdb&#39; fill that libsodium&#39;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with &#39;0xdb&#39; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are &#39;0xdb&#39; to &#39;dnscrypt-port&#39; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (&#39;--enable-dnscrypt&#39;).</p> <p><strong>Affected:</strong> NLnet Labs Unbound</p> <p>In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the &#39;dnscrypt:&#39; clause lists more &#39;dnscrypt-provider-cert:&#39; files than there are matching &#39;dnscrypt-secret-key:&#39; files, Unbound fills only the matched prefix and leaves the tail slots at the &#39;0xdb&#39; fill that libsodium&#39;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with &#39;0xdb&#39; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are &#39;0xdb&#39; to &#39;dnscrypt-port&#39; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (&#39;--enable-dnscrypt&#39;).</p> https://cve.radiocsirt.org/vuln/cve-2026-55990