Detections
Analytics

Echo: unbound: security update to 1.25.2

medium Tenable Cloud Security Plugin ID 459713

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a
 libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a
 single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value
 passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound
 continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1'
 is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The
 follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer;
 because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n <
 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can
 trigger this deterministically with a single QUIC connection by advertising
 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without
 ever reading the stream. (CVE-2026-55991)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-55991

Plugin Details

Severity: Medium

ID: 459713

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-55991

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-55991