Detections
Analytics

Echo: unbound: security update to 1.25.2

low Tenable Cloud Security Plugin ID 465794

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of
 data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache,
 before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure
 on the rrset, and another thread that is on the serve expired path then picks up the updated rrset
 contents with the secure status for a reply, it can be used to change a specific record, next to a
 wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the
 possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME
 wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then
 quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry)
 query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is
 injected into the response, the wildcard rrset will update the expired sibling record with a secure status
 before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper
 answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability
 is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC
 accompanying rrset. (CVE-2026-46582)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-46582

Plugin Details

Severity: Low

ID: 465794

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 50.4

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-46582

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-46582