openSUSE 16: libunbound8 / python3-unbound / unbound / unbound-anchor / etc (openSUSE-SU-2026:21550-1)

high Nessus Plugin ID 335078

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21550-1 advisory.

Update to version 1.25.2.

Security issues fixed:

- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).
- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS- over-QUIC queries (bsc#1271891).
- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly terminated (bsc#1271876).
- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate parent's `NXDOMAIN` (bsc#1271893).
- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).
- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).
- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).
- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).
- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).
- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).
- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).
- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client- timeout` are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

- Version 1.25.2:
- Features:
* TTL behavior changes: cached records reaching TTL 0 are expired;
TTL 0 upstream answers are no longer cached by cachedb;
serve-expired-reply-ttl is now capped by the original TTL value;
TTL decoding updated to adhere to RFC 8767 section 4
* Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
* Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
* Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
* Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
* Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
* Allow ip@port notation in control-interface configuration
* Add iter-scrub-rrsig option (default: 8) to limit the number of RRSIGs processed by the scrubber
* Add 'tls-protocols' configuration option to select which TLS protocol versions are used; TLSv1.2 is re-enabled by default
* Add pthread_setname_np support for named threads
- Bug Fixes:
* Fix handle leak in pythonmod on pythonmod_init
* Fix crash when mesh_detect_cycle_found() is called with no mesh state
* Fix modstack_call_init to use the original string when it has changed
* Fix fr_atomic_copy_cfg
* Fix auth-zone empty label for $ORIGIN when downloading via HTTP
* Fix respip and dns64 to be usable simultaneously; RPZ now works with DNS64
* Fix HTTPS and QUIC not being enabled when port is listed in interface-automatic-ports
* Allow wait-limit-cookie: 0 to disable cookie-validated wait limits
* Fix FIPS mode in OpenSSL causing unit test failure
* Fix discard-timeout to only drop UDP, not stream connections
* Reply with SERVFAIL when the wait-limit is exceeded
* Add extended DNS error code for invalid query type
* Replace deprecated SWIG $function with $action
* Log a warning for possible circular dependency when using hostnames in stub/forward zones
* Fix infra cache for NAT64 by moving NAT64 synthesis to the delegation point when adding target addresses
* Fix discard-timeout packet accounting in the mesh area
* Update IANA portlist
* Copy DNSTAP configuration from daemon to workers after fast_reload
* Fix HTTP/2 stream mesh state removal and drop handling for postpone_drop and send failures
* Log THROWAWAY and (DNSSEC) LAME responses with clearer categorization in log output
* Fix EDE removal logic consistency between encoding errors and encoding replies
* Fix EDNS subnet scope-zero queries not being stored when forward-no-cache or stub-no-cache is set
* Do not initialize quic_table unless QUIC is enabled
* Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and max_global_quota options
* Fix allow-notify entries with hostnames to be copied after IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs are configured
* Fix NAT64 inconsistency with do-not-query-address during retries
* Fix cachedb aggressive negative responses not setting the RA flag
* Fix root key priming failure after loading RPZ zones containing ZONEMD RRtype
* Fix local-zone always_refuse to also block DS queries
* Fix cache lookup/store in external cachedb when forwarder/stub uses the no-cache option
* Fix cachedb returning expired bogus data as non-bogus
* Fix validator unchecked state handling with validation recursion and EDNS subnet
* Fix DNAME lookup flag and assertion in expired calculation debug routine
* Fix DNS rebinding bypass via SVCB/HTTPS records; private-address now also elides SVCB and HTTPS records matching the filter
* Warn for unused 'nodefault' local-zone configuration in unbound-checkconf
* Fix lock/unlock for view in memory error handling
* Apply cache TTL policy to DNAME and synthesized CNAME on the wire path
* Fix detection of HTTP listening port in fast_reload
* Fix ignoring out-of-zone DNAME records for CNAME synthesis
* Fix invalid HTTP content length/chunk size checks and RR rdata field length validation in zone transfer, preventing heap buffer-overflow read errors
* Fix defense in depth for service callback with empty packet
* Fix shared memory statistics with threads
* Fix EDNS client subnet to not store SERVFAIL in the global cache after a failed lookup; stores a short-lived failure entry in the subnet cache instead
* Fix memory corruption related core dumps when alloc_reg_obtain encounters an empty list
* Fix RFC 7766 compliance when client sends EOF over TCP
* Fix DoH session cleanup when the same query appears on multiple streams
* Fix TLS context setup for tls-service-pem
* Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values
* Fix memory leak in subnet SERVFAIL store
* Fix for the Jiggle Attack: server now answers errors for error cases and no longer reflects parts of the incoming query
* Fix EDNS extended RCODE reflection: server no longer echoes extended RCODE values after CHAOS class queries
* Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN answers that contain a DNAME record
* Fix missing bounds check when decompressing dnames for downloaded authority zones, preventing malformed content from truncated AXFR packets
* Fix upstream TLS connections being reused for different names at the same IP address
* Fix to disallow signatures with revoked DNSKEYs
* Fix DNAME with unsigned CNAME to check for the correct match, preventing certain zone configurations from granting secure status to unchecked CNAMEs
* Fix wildcard CNAME handling in the chain of trust
* Fix buffer overrun in doq_repinfo_retrieve_localaddr()
- Packaging changes:
* Update keyring to new NLnet Labs release signing key

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 335078

File Name: openSUSE-2026-21550-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/13/2026

Updated: 8/13/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.8

Percentile: 96.81

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-50252

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-40622

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:libunbound8, p-cpe:/a:novell:opensuse:python3-unbound, p-cpe:/a:novell:opensuse:unbound-anchor, p-cpe:/a:novell:opensuse:unbound-devel, p-cpe:/a:novell:opensuse:unbound-munin, p-cpe:/a:novell:opensuse:unbound

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/10/2026

Vulnerability Publication Date: 5/20/2026

Reference Information

CVE: CVE-2026-14586, CVE-2026-32665, CVE-2026-40622, CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621, CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-54478, CVE-2026-55708, CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991, CVE-2026-56416, CVE-2026-56444

Detections

Analytics