Detections
Analytics

Echo: unbound: security update to 1.26.2

low Tenable Cloud Security Plugin ID 477080

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust
 anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure
 under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick
 Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in
 Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator
 was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old
 fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

Solution

Update the unbound library and its related packages to version 1.26.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-35501

Plugin Details

Severity: Low

ID: 477080

Version: Revision 1.1

Type: Local

Published: 10/23/2026

Updated: 10/23/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-35501

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/21/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-35501

IAVA: 2026-A-1194