Detections
Analytics

Echo: unbound: security update to 1.26.1

critical Tenable Self-Hosted Container Security Plugin ID 462153

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively
 corrupt heap memory and under certain systems and compilation options could lead to remote code execution.
 The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max
 TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value
 and invalidates the domain name, it leads to an error path that does not properly move the buffer position
 and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are
 memory corruption that eventually leads to a crash and under specific systems and compilation options
 remote code execution. (CVE-2026-82717)

Solution

Update the unbound library and its related packages to version 1.26.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-82717

Plugin Details

Severity: Critical

ID: 462153

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-82717

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.5

Threat Score: 8.4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/16/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-82717

IAVA: 2026-A-1070