Detections
Analytics

Alpine: multiple unbound packages, py3-unbound: security update to 1.20.0-r2

high Tenable Self-Hosted Container Security Plugin ID 435910

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching
 resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS
 support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream
 name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-
 always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to
 accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox
 attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous
 replies. (CVE-2025-5994)

 - NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick
 resolvers to update their delegation information for the zone. Usually these RRSets are used to update the
 resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous
 effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be
 done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to
 update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for
 the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their
 respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an
 additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and
 non-referral nodata replies, further mitigating the possible poison effect. (CVE-2025-11411)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-11411

https://security.alpinelinux.org/vuln/CVE-2025-5994

Plugin Details

Severity: High

ID: 435910

Version: Revision 1.11

Type: Local

Published: 11/3/2025

Updated: 6/29/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.26

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2025-5994

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/16/2025

Reference Information

CVE: CVE-2025-11411, CVE-2025-5994