There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be
    exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-
    like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does
    not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count
    reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache
    clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can
    distinguish whether a candidate port matches the current upstream source port by checking whether an
    existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to
    probe the upstream source port. Although the attack is not feasible on default configurations and the
    suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the
    attacker can keep a concurrent query window alive, the attacker can first filter the source port and then
    perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792811393 advisory.

  - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

  - When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

  - NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust. (CVE-2026-40622)

  - When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and     an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the     root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island,     with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the     root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated     as insecure and denying existence for records in the trust island. (CVE-2026-50106)

  - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0be28489-cd2f-11f1-8135-8447094a420f advisory.

    NLNetLabs reports:
    This release consolidates security fixes for issues reported over     a period of time.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3313 advisory.

    In NLnet Labs Unbound up to and including version 1.26.1, an observable  cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

    When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

    When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and     an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the     root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island,     with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the     root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated     as insecure and denying existence for records in the trust island. (CVE-2026-50106)

    NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6581-1                   security@debian.org     https://www.debian.org/security/                        Yves-Alexis Perez     October 23, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-35501 CVE-2026-50106 CVE-2026-96405 CVE-2026-97206                      CVE-2026-109125

    Multiple security vulnerabilities were discovered in Unbound, a validating,     recursive, caching DNS resolver.

    CVE-2026-35501

        (DNSSEC) Bypass of a configured island trust anchor underneath an insecure         parent from an attacker-controlled NSEC record.

    CVE-2026-50106

        (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a         configured island trust anchor underneath an insecure parent.

    CVE-2026-96405

        Aggregate DNS name chained pointer decompression work leads to degradation         of service.

    CVE-2026-97206

        DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded         deployments, leading to potential denial of service.

    CVE-2026-109125

        Possible cache poisoning vulnerability via a cache side-channel exposed by         'unwanted-reply-threshold'.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-0+deb13u1.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
477069	Echo: unbound: security update to 1.26.2	Tenable Cloud Security	Echo Local Security Checks	10/23/2026	10/23/2026	medium
477069	Echo: unbound: security update to 1.26.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/23/2026	10/23/2026	medium
372098	CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792811393)	Nessus	CentOS Local Security Checks	10/26/2026	10/26/2026	high
370456	FreeBSD : Unbound -- Multiple vulnerabilities (0be28489-cd2f-11f1-8135-8447094a420f)	Nessus	FreeBSD Local Security Checks	10/22/2026	10/23/2026	medium
371837	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-3313)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	medium
370061	Linux Distros Unpatched Vulnerability : CVE-2026-109125	Nessus	Misc.	10/21/2026	10/26/2026	medium
371252	Debian dsa-6581 : libunbound-dev - security update	Nessus	Debian Local Security Checks	10/23/2026	10/23/2026	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

medium

medium