Detections
Analytics

Echo: unbound: security update to 1.25.2

high Tenable Self-Hosted Container Security Plugin ID 463072

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS
 Report-Channel option (code 18) from the last upstream response is read and uses the option's length as
 the length of the agent domain. When a domain name check is performed on the agent domain, the returned
 lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of
 the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to
 send out the DNS Error Report and when Unbound tries to walk that query name during
 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the
 embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label
 length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the
 attacker controls is sufficient to terminate the daemon. (CVE-2026-55973)

Solution

Update the unbound library and its related packages to version 1.25.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-55973

Plugin Details

Severity: High

ID: 463072

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.95

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-55973

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-55973