The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790962865 advisory.

  - In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired:
    yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the     discard-timeout branch during the serve expired logic drops an aged client reply without performing the     correct accounting for the number of reply addresses for the query. Other identical branches outside of     serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it     can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting     in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the     resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the     threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the     branch unreachable. (CVE-2026-56444)

  - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones     (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where     (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is     caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check     completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered     data are reloaded on startup and available until ZONEMD verification concludes again. If verification     fails, the data is not served any more but still persists on disk for future reloads. (CVE-2026-77955)

  - NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for     DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle     due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account     properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If     the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger     the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads     are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can     catch the use-after-free and controllably terminate the process resulting to denial of service.
    (CVE-2026-82720)

  - Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the     term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the     algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to     some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant     attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and     DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY     and DS records from the root zone downward. For deeply nested domains, this results in significant     computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver     to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL     section as well. This can be exploited to waste validation resources by malicious users. (CVE-2026-85501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790962865)

high Nessus Plugin ID 362706

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 20, 2026, 5:14 PM CVE (set "CVE" coverage to "CVE-2026-56444,CVE-2026-77955,CVE-2026-82720,CVE-2026-85501") Plugin metadata Plugin Feed: 202610201714
Version 1.2 Oct 10, 2026, 5:24 AM Plugin metadata (Add IAVM Info) Plugin Feed: 202610100524
Version 1.1 Oct 2, 2026, 11:09 PM New Plugin Feed: 202610022309