Detections
Analytics

Echo: unbound: security update to 1.25.2

medium Tenable Cloud Security Plugin ID 461674

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT)
 forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct
 ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still
 handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it
 dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash
 resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration
 could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder
 pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of
 jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a
 vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured
 '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a
 transient failure at the correct time in order to kick off the vulnerable error path. (CVE-2026-50046)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-50046

Plugin Details

Severity: Medium

ID: 461674

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-50046

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-50046