There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each
    individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained
    compression pointers in a message results in a lot of CPU usage following them. A malicious actor with
    recursive-query access and control of an ordinarily delegated authority that serves specially crafted
    replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0be28489-cd2f-11f1-8135-8447094a420f advisory.

    NLNetLabs reports:
    This release consolidates security fixes for issues reported over     a period of time.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3313 advisory.

    In NLnet Labs Unbound up to and including version 1.26.1, an observable  cache-level side-channel can be     exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-     like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does     not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count     reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache     clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can     distinguish whether a candidate port matches the current upstream source port by checking whether an     existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to     probe the upstream source port. Although the attack is not feasible on default configurations and the     suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the     attacker can keep a concurrent query window alive, the attacker can first filter the source port and then     perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
    (CVE-2026-109125)

    When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust     anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure     under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick     Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in     Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator     was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old     fix for type DS and NSEC queries from clients when trust anchor for that name existed. (CVE-2026-35501)

    When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and     an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the     root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island,     with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the     root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated     as insecure and denying existence for records in the trust island. (CVE-2026-50106)

    NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each     individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained     compression pointers in a message results in a lot of CPU usage following them. A malicious actor with     recursive-query access and control of an ordinarily delegated authority that serves specially crafted     replies can exploit the vulnerability and degrade Unbound's general performance. (CVE-2026-96405)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6581-1                   security@debian.org     https://www.debian.org/security/                        Yves-Alexis Perez     October 23, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-35501 CVE-2026-50106 CVE-2026-96405 CVE-2026-97206                      CVE-2026-109125

    Multiple security vulnerabilities were discovered in Unbound, a validating,     recursive, caching DNS resolver.

    CVE-2026-35501

        (DNSSEC) Bypass of a configured island trust anchor underneath an insecure         parent from an attacker-controlled NSEC record.

    CVE-2026-50106

        (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a         configured island trust anchor underneath an insecure parent.

    CVE-2026-96405

        Aggregate DNS name chained pointer decompression work leads to degradation         of service.

    CVE-2026-97206

        DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded         deployments, leading to potential denial of service.

    CVE-2026-109125

        Possible cache poisoning vulnerability via a cache side-channel exposed by         'unwanted-reply-threshold'.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-0+deb13u1.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
477033	Echo: unbound: security update to 1.26.2	Tenable Cloud Security	Echo Local Security Checks	10/23/2026	10/23/2026	medium
477033	Echo: unbound: security update to 1.26.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/23/2026	10/23/2026	medium
370456	FreeBSD : Unbound -- Multiple vulnerabilities (0be28489-cd2f-11f1-8135-8447094a420f)	Nessus	FreeBSD Local Security Checks	10/22/2026	10/23/2026	medium
371837	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-3313)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	medium
370024	Linux Distros Unpatched Vulnerability : CVE-2026-96405	Nessus	Misc.	10/21/2026	10/24/2026	medium
371252	Debian dsa-6581 : libunbound-dev - security update	Nessus	Debian Local Security Checks	10/23/2026	10/23/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium