Repository navigation
CVE-2026-55990 (Medium) detected in src4.0.4 #476
Description
CVE-2026-55990 - Medium Severity Vulnerability
Vulnerable Library - src4.0.4
MidnightBSD OS source code
Library home page: https://github.com/MidnightBSD/src.git
Found in HEAD commit: 816463d989cc5839c1cca2efb5bf2503408507fb
Found in base branches: stable/4.0, master
Vulnerable Source Files (1)
Vulnerability Details
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').
Publish Date: 2026-07-22
URL: CVE-2026-55990
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
Activity
[-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+][-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+]mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]CVE-2026-55990 (Medium) detected in src4.0.4[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4 - autoclosed[/+]mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]CVE-2026-55990 (Medium) detected in src4.0.4 - autoclosed[/-][+]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/+]mend-bolt-for-github commentedon Oct 7, 2026
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
[-]CVE-2026-55990 (Medium) detected in freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-55990 (Medium) detected in src4.0.4[/+]