Detections
Analytics

Echo: unbound: security update to 1.25.2

high Tenable Self-Hosted Container Security Plugin ID 461975

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that
 encrypts the reply in place fails to bound the reply length against the destination buffer size. The size
 clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is
 shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end
 of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of
 service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and
 the 'dnscrypt:' clause to be configured and enabled for the listening interfaces. (CVE-2026-40691)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-40691

Plugin Details

Severity: High

ID: 461975

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-40691

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-40691