Detections
Analytics

Echo: unbound: security update to 1.25.1-1

medium Tenable Cloud Security Plugin ID 465250

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where
 the code path to consult the negative cache for DS records does not take into account the limit on NSEC3
 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An
 adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably
 high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the
 allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in
 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the
 hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise
 the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable
 code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

Solution

Update the unbound library and its related packages to version 1.25.1-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-42923

Plugin Details

Severity: Medium

ID: 465250

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-42923

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/21/2026

Vulnerability Publication Date: 5/20/2026

Reference Information

CVE: CVE-2026-42923