Echo: unbound: security update to 1.25.2

medium Tenable Self-Hosted Container Security Plugin ID 460861

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired:
yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the
discard-timeout branch during the serve expired logic drops an aged client reply without performing the
correct accounting for the number of reply addresses for the query. Other identical branches outside of
serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it
can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting
in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the
resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the
threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the
branch unreachable. (CVE-2026-56444)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

Plugin Details

Severity: Medium

ID: 460861

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-56444

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-56444

Detections

Analytics