When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab4f7ff50a advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7b16c1d7fc advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9142230324 advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792811393 advisory.

  - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

  - When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

  - NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust. (CVE-2026-40622)

  - When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and     an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the     root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island,     with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the     root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated     as insecure and denying existence for records in the trust island. (CVE-2026-50106)

  - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3313 advisory.

    In NLnet Labs Unbound up to and including version 1.26.1, an observable  cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

    When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

    When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and     an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the     root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island,     with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the     root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated     as insecure and denying existence for records in the trust island. (CVE-2026-50106)

    NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust
    anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure
    under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick
    Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in
    Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator
    was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old
    fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6581-1                   security@debian.org     https://www.debian.org/security/                        Yves-Alexis Perez     October 23, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-35501 CVE-2026-50106 CVE-2026-96405 CVE-2026-97206                      CVE-2026-109125

    Multiple security vulnerabilities were discovered in Unbound, a validating,     recursive, caching DNS resolver.

    CVE-2026-35501

        (DNSSEC) Bypass of a configured island trust anchor underneath an insecure         parent from an attacker-controlled NSEC record.

    CVE-2026-50106

        (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a         configured island trust anchor underneath an insecure parent.

    CVE-2026-96405

        Aggregate DNS name chained pointer decompression work leads to degradation         of service.

    CVE-2026-97206

        DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded         deployments, leading to potential denial of service.

    CVE-2026-109125

        Possible cache poisoning vulnerability via a cache side-channel exposed by         'unwanted-reply-threshold'.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-0+deb13u1.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0be28489-cd2f-11f1-8135-8447094a420f advisory.

    NLNetLabs reports:
    This release consolidates security fixes for issues reported over     a period of time.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
378691	Fedora 43 : unbound (2026-ab4f7ff50a)	Nessus	Fedora Local Security Checks	Local	medium
374616	Fedora 45 : unbound (2026-7b16c1d7fc)	Nessus	Fedora Local Security Checks	Local	medium
373489	Fedora 44 : unbound (2026-9142230324)	Nessus	Fedora Local Security Checks	Local	medium
372098	CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792811393)	Nessus	CentOS Local Security Checks	Local	high
371837	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-3313)	Nessus	Amazon Linux Local Security Checks	Local	medium
477080	Echo: unbound: security update to 1.26.2	Tenable Cloud Security	Echo Local Security Checks	Local	low
477080	Echo: unbound: security update to 1.26.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
371252	Debian dsa-6581 : libunbound-dev - security update	Nessus	Debian Local Security Checks	Local	medium
370456	FreeBSD : Unbound -- Multiple vulnerabilities (0be28489-cd2f-11f1-8135-8447094a420f)	Nessus	FreeBSD Local Security Checks	Local	medium
370046	Linux Distros Unpatched Vulnerability : CVE-2026-35501	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-35501

low

Tenable Plugins

medium

medium

medium

high

medium

low

low

medium

medium

low