Detections
Analytics

Echo: unbound: security update to 1.22.0-2+e1

high Tenable Cloud Security Plugin ID 457246

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick
 resolvers to update their delegation information for the zone. Usually these RRSets are used to update the
 resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous
 effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be
 done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to
 update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for
 the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their
 respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an
 additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and
 non-referral nodata replies, further mitigating the possible poison effect. (CVE-2025-11411)

Solution

Update the unbound library and its related packages to version 1.22.0-2+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-11411

Plugin Details

Severity: High

ID: 457246

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.26

CVSS v2

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 3.9

Vector: CVSS2#AV:A/AC:H/Au:N/C:N/I:C/A:P

CVSS Score Source: CVE-2025-11411

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2025

Vulnerability Publication Date: 10/22/2025

Reference Information

CVE: CVE-2025-11411