CVE-2026-32792

{"id": "CVE-2026-32792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T12:15:56.617664Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green", "exploitMaturity": "UNREPORTED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.6.2", "lessThan": "1.25.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T10:16:26.277", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt", "tags": ["Mitigation", "Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-166"}]}], "descriptions": [{"lang": "en", "value": "NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space."}, {"lang": "es", "value": "NLnet Labs Unbound 1.6.2 hasta e incluyendo la versi\u00f3n 1.25.0 tiene una vulnerabilidad de denegaci\u00f3n de servicio cuando se compila con soporte para DNSCrypt ('--enable-dnscrypt'). Una consulta DNSCrypt incorrecta podr\u00eda causar un underflow en el procedimiento de lectura de paquetes DNSCrypt de Unbound que puede llevar a un desbordamiento de mont\u00edculo. Un actor malicioso puede explotar la vulnerabilidad con una \u00fanica consulta DNSCrypt incorrecta cuyo texto plano descifrado consiste enteramente en bytes '0x00' y no contiene el marcador '0x80' esperado. Unbound entonces comenzar\u00eda a leer m\u00e1s bytes de los necesarios hasta que encuentre un byte que no sea '0x00'. Basado en el asignador de memoria subyacente y la disposici\u00f3n de la memoria, podr\u00eda llevar a un desbordamiento de mont\u00edculo durante la lectura seguido de un fallo. La probabilidad de un fallo es baja, ya que depende en gran medida del asignador de memoria subyacente y de la disposici\u00f3n de la memoria. Si el desbordamiento de mont\u00edculo no ocurre, las comprobaciones posteriores de paquetes de Unbound denegar\u00e1n el paquete. Unbound 1.25.1 contiene un parche con una correcci\u00f3n para limitar la lectura en el espacio de b\u00fafer dado."}], "lastModified": "2026-07-24T10:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2A7CA69-1A30-44D8-A0FF-2A4853C6F6D9", "versionEndExcluding": "1.25.1", "versionStartIncluding": "1.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}