Detections
Analytics

Echo: unbound: security update to 1.26.2

medium Tenable Cloud Security Plugin ID 477069

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be
 exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-
 like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does
 not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count
 reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache
 clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can
 distinguish whether a candidate port matches the current upstream source port by checking whether an
 existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to
 probe the upstream source port. Although the attack is not feasible on default configurations and the
 suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the
 attacker can keep a concurrent query window alive, the attacker can first filter the source port and then
 perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
 (CVE-2026-109125)

Solution

Update the unbound library and its related packages to version 1.26.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-109125

Plugin Details

Severity: Medium

ID: 477069

Version: Revision 1.1

Type: Local

Published: 10/23/2026

Updated: 10/23/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.71

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:A/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-109125

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/21/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-109125

IAVA: 2026-A-1194