NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab4f7ff50a advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7b16c1d7fc advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9142230324 advisory.

    ## Update to 1.26.2 (rhbz#2558169)

    Security fixes from the upstream changelog:

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks     to Kunta Chu and Jianjun Chen from Tsinghua University for the report.
    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust     anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.
    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of     service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen     (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.
    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by     'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen     (Tsinghua University) for the report.
    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an     attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug
    reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration
    can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup
    frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer
    leading to a crash. (CVE-2026-97206)

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6581-1                   security@debian.org     https://www.debian.org/security/                        Yves-Alexis Perez     October 23, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-35501 CVE-2026-50106 CVE-2026-96405 CVE-2026-97206                      CVE-2026-109125

    Multiple security vulnerabilities were discovered in Unbound, a validating,     recursive, caching DNS resolver.

    CVE-2026-35501

        (DNSSEC) Bypass of a configured island trust anchor underneath an insecure         parent from an attacker-controlled NSEC record.

    CVE-2026-50106

        (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a         configured island trust anchor underneath an insecure parent.

    CVE-2026-96405

        Aggregate DNS name chained pointer decompression work leads to degradation         of service.

    CVE-2026-97206

        DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded         deployments, leading to potential denial of service.

    CVE-2026-109125

        Possible cache poisoning vulnerability via a cache side-channel exposed by         'unwanted-reply-threshold'.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-0+deb13u1.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0be28489-cd2f-11f1-8135-8447094a420f advisory.

    NLNetLabs reports:
    This release consolidates security fixes for issues reported over     a period of time.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug     reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration     can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup     frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer     leading to a crash. (CVE-2026-97206)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
378691	Fedora 43 : unbound (2026-ab4f7ff50a)	Nessus	Fedora Local Security Checks	Local	medium
374616	Fedora 45 : unbound (2026-7b16c1d7fc)	Nessus	Fedora Local Security Checks	Local	medium
373489	Fedora 44 : unbound (2026-9142230324)	Nessus	Fedora Local Security Checks	Local	medium
477100	Echo: unbound: security update to 1.26.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
477100	Echo: unbound: security update to 1.26.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
371252	Debian dsa-6581 : libunbound-dev - security update	Nessus	Debian Local Security Checks	Local	medium
370456	FreeBSD : Unbound -- Multiple vulnerabilities (0be28489-cd2f-11f1-8135-8447094a420f)	Nessus	FreeBSD Local Security Checks	Local	medium
370033	Linux Distros Unpatched Vulnerability : CVE-2026-97206	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-97206

high

Tenable Plugins

medium

medium

medium

high

high

medium

medium

high