Detections
Analytics

Echo: unbound: security update to 1.25.1-1

medium Tenable Cloud Security Plugin ID 462104

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could
 defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age
 of slow running queries and not allow the jostle logic to see them as aged and potential targets for
 replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain
 name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and
 degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,
 the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to
 resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need
 resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the
 original one that started the resolution effort. Cache and local data response performance remains
 unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1
 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow
 the jostle logic to work as intended. (CVE-2026-42534)

Solution

Update the unbound library and its related packages to version 1.25.1-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-42534

Plugin Details

Severity: Medium

ID: 462104

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-42534

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/21/2026

Vulnerability Publication Date: 5/20/2026

Reference Information

CVE: CVE-2026-42534