The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an     intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure     NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic;
    enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is     never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point     guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but     before stripping a label. This results in an iteration where the domain name equals the configured     stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's     immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private     namespace nested two or more labels under a signed public name, the walk returns it and the configured     stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate     label (between the stub/forward apex and the DNSSEC parent zone). (CVE-2026-44687)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-44687

low Nessus Plugin ID 329687

Version 1.11