CVE-2026-40691

Vendor

Canonical, Microsoft

Product

dnsmasq / Unbound / PowerDNS

CVSS

7.5

EPSS

0.003 (p21)

Exposure class

Operating system, Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 53
   Ubuntu notice Ubuntu 4h ago

   Unbound vulnerabilities

   USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding update for…

   CVE-2026-80225CVE-2026-81634CVE-2026-85501+5 more Canonical
2. 34
   CVE NVD 22 Jul 2026

   In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound…

   In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that…

   CVSS 7.5 CVE-2026-40691
3. 20
   Advisory MSRC 23 Jul 2026

   CVE-2026-40691 Packet of death for DNSCrypt over TCP

   Information published.

   CVE-2026-40691 Microsoft