Bug 2479779 (CVE-2026-32792)

Summary: CVE-2026-32792 unbound: Packet of death with DNSCrypt
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending a specially crafted DNSCrypt query. This malicious query, when processed, causes Unbound to read beyond its allocated memory, leading to a heap overflow. This can result in a denial of service (DoS) by crashing the Unbound service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2523415    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-19 10:39:11 UTC 
A malicious actor can exploit the vulnerability with a single bad DNSCrypt
query that its decrypted plaintext consists entirely of `0x00` bytes and does
not contain the expected `0x80` marker.

Unbound would then start reading more bytes than necessary until it finds a
non-`0x00` byte.
Based on the underlying memory allocator and the memory layout, it could lead
to heap overflow while reading followed by a crash.

Likelihood of a crash is low, since it relies heavily on the underlying memory
allocator and the memory layout.

If the heap overflow does not happen, Unbound's later packet checks will deny
the packet.

Unbound 1.25.1 includes a fix to bound reading in the given buffer space.