Detections
Analytics

Echo: unbound: security update to 1.26.1

low Tenable Cloud Security Plugin ID 458480

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path
 can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the
 counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by
 controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one
 the attacker's authoritative never answers, is followed by one query for an expired cached name, which is
 answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was
 named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below
 the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a
 single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the
 counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-
 expired' code path. (CVE-2026-77860)

Solution

Update the unbound library and its related packages to version 1.26.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-77860

Plugin Details

Severity: Low

ID: 458480

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-77860

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/16/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-77860