Detections
Analytics

Echo: unbound: security update to 1.25.1-1

high Tenable Self-Hosted Container Security Plugin ID 457844

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack
 related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS
 options can hold Unbound threads hostage while they are parsing and creating internal data structures for
 the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1
 contains a patch with a fix to limit acceptable incoming EDNS options (100). (CVE-2026-41292)

Solution

Update the unbound library and its related packages to version 1.25.1-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-41292

Plugin Details

Severity: High

ID: 457844

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-41292

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/21/2026

Vulnerability Publication Date: 5/20/2026

Reference Information

CVE: CVE-2026-41292