The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e495bd59ef advisory.

    Update to 1.25.2 (rhbz#2506061)

    Security fixes:

    - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC     environments. Thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University, for the report.
    - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass. Thanks to     N0zoM1z0 (https://github.com/N0zoM1z0) for the report. In addition, thanks to Kunta Chu, Kaihua Wang, and     Jianjun Chen from Tsinghua University, for also reporting this issue. In addition, thanks to Qifan Zhang,     Palo Alto Networks, for also reporting this issue. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks to Qifan Zhang, Palo Alto Networks,     for the report. In addition, thanks to Trung Nguyen (@everping) of CyStack, for also reporting this issue.
    - Fix CVE-2026-41637, Degradation of resolution service from improperly accounted client-terminated DNS-     over-QUIC queries. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a     one-time 'ghost domain' delegation renewal via glue records. Thanks to Qifan Zhang, Palo Alto Networks,     for the report.
    - Fix CVE-2026-44621, Libunbound applications configured with 'unwanted-reply-threshold' could eventually     be abruptly terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by     a legitimate parent's NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via RRSIG.labels manipulation. Thanks to Qifan     Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-46582, A wildcard replay, as another piece of data, triggers poisoning in the serve expired     reply path. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation restarts. Thanks to Kunjie Shang,     University of Science and Technology of China, for the report.
    - Fix CVE-2026-50046, Possible heap use-after-free in an error path when a DoT forwarded query is jostled     out. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL. Thanks     to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for XFR in auth/rpz zones. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50251, Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50252, Possible cache poisoning attack by mapping source port population per thread. Thanks     to Inbal Schussheim and Amit Klein, Hebrew University, for the report.
    - Fix CVE-2026-52863, Memory corruption could lead to crash and denial of service. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-54478, DNS Cookie bypass when combined with proxy-protocol use. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55708, Privacy/configuration issue when adding local data in views through 'unbound-     control'. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a     crash. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin Wang, Jiapeng     Li, and Jiajia Liu, Northwestern Polytechnical University, for also reporting this issue.
    - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured Unbound. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2. Thanks to     Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-56416, Possible heap buffer overflow when validator canonicalizes RDATA that contains     domain name. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-56444, Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-     timeout' are combined in unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for     also reporting this issue. In addition, thanks to Haruki Oyama (Waseda University), for also reporting     this issue.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a     libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a     single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value     passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound     continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1'     is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The     follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer;
    because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n <     4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can     trigger this deterministically with a single QUIC connection by advertising     'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without     ever reading the stream. (CVE-2026-55991)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f63b4b88-6901-4c12-b13d-5a821e25e9bf advisory.

    NLnet Labs reports:
    This release consolidates security fixes for issues reported                 over a period of time. There are fixes for:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the unbound package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21550-1 advisory.

    Update to version 1.25.2.

    Security issues fixed:

    - CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency     (bsc#1271879).
    - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).
    - CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
    - CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-     over-QUIC queries       (bsc#1271891).
    - CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA     glue records       (bsc#1271892).
    - CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be     abruptly       terminated (bsc#1271876).
    - CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a     legitimate       parent's `NXDOMAIN` (bsc#1271893).
    - CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).
    - CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server     expired reply       path (bsc#1271894).
    - CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a     DNSSEC-signed       parent (bsc#1271878).
    - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out     (bsc#1271882).
    - CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL     (bsc#1271880).
    - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
    - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).
    - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread     (bsc#1271884).
    - CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used     (bsc#1271895).
    - CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control`     (bsc#1271896).
    - CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash     (bsc#1271886).
    - CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set     (bsc#1271874).
    - CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
    - CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2`     (bsc#1271888).
    - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain     name       (bsc#1271889).
    - CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-     timeout` are       combined in unusual configuration (bsc#1271890).

    Other updates and bugfixes:

    - Version 1.25.2:
      - Features:
        * TTL behavior changes: cached records reaching TTL 0 are expired;
          TTL 0 upstream answers are no longer cached by cachedb;
          serve-expired-reply-ttl is now capped by the original TTL value;
          TTL decoding updated to adhere to RFC 8767 section 4
        * Add new statistics: num.queries.replyaddr_limit and           requestlist.current.replies
        * Add 'log-thread-id' configuration option to log the system-wide           Linux thread ID for easier debugging
        * Add ECC-GOST12 support per RFC 9558 (available as           contrib/gost12.patch)
        * Allow synthesized DNAME TTL=0 to be served from cache within a           1-second grace period, reducing recursion for TTL=0 DNAMEs           (RFC 2308)
        * Fix DoT/DoH/DoQ to reload certificates on config reload without           requiring a full restart; fast_reload now supports changes to           tls-service-key, tls-service-pem and tls-cert-bundle
        * Allow ip@port notation in control-interface configuration
        * Add iter-scrub-rrsig option (default: 8) to limit the number of           RRSIGs processed by the scrubber
        * Add 'tls-protocols' configuration option to select which TLS           protocol versions are used; TLSv1.2 is re-enabled by default
        * Add pthread_setname_np support for named threads
      - Bug Fixes:
        * Fix handle leak in pythonmod on pythonmod_init
        * Fix crash when mesh_detect_cycle_found() is called with no mesh           state
        * Fix modstack_call_init to use the original string when it has           changed
        * Fix fr_atomic_copy_cfg
        * Fix auth-zone empty label for $ORIGIN when downloading via HTTP
        * Fix respip and dns64 to be usable simultaneously; RPZ now works           with DNS64
        * Fix HTTPS and QUIC not being enabled when port is listed in           interface-automatic-ports
        * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits
        * Fix FIPS mode in OpenSSL causing unit test failure
        * Fix discard-timeout to only drop UDP, not stream connections
        * Reply with SERVFAIL when the wait-limit is exceeded
        * Add extended DNS error code for invalid query type
        * Replace deprecated SWIG $function with $action
        * Log a warning for possible circular dependency when using hostnames           in stub/forward zones
        * Fix infra cache for NAT64 by moving NAT64 synthesis to the           delegation point when adding target addresses
        * Fix discard-timeout packet accounting in the mesh area
        * Update IANA portlist
        * Copy DNSTAP configuration from daemon to workers after fast_reload
        * Fix HTTP/2 stream mesh state removal and drop handling for           postpone_drop and send failures
        * Log THROWAWAY and (DNSSEC) LAME responses with clearer           categorization in log output
        * Fix EDE removal logic consistency between encoding errors and           encoding replies
        * Fix EDNS subnet scope-zero queries not being stored when           forward-no-cache or stub-no-cache is set
        * Do not initialize quic_table unless QUIC is enabled
        * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and           max_global_quota options
        * Fix allow-notify entries with hostnames to be copied after           IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs           are configured
        * Fix NAT64 inconsistency with do-not-query-address during retries
        * Fix cachedb aggressive negative responses not setting the RA flag
        * Fix root key priming failure after loading RPZ zones containing           ZONEMD RRtype
        * Fix local-zone always_refuse to also block DS queries
        * Fix cache lookup/store in external cachedb when forwarder/stub           uses the no-cache option
        * Fix cachedb returning expired bogus data as non-bogus
        * Fix validator unchecked state handling with validation recursion           and EDNS subnet
        * Fix DNAME lookup flag and assertion in expired calculation debug           routine
        * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address           now also elides SVCB and HTTPS records matching the filter
        * Warn for unused 'nodefault' local-zone configuration in           unbound-checkconf
        * Fix lock/unlock for view in memory error handling
        * Apply cache TTL policy to DNAME and synthesized CNAME on the           wire path
        * Fix detection of HTTP listening port in fast_reload
        * Fix ignoring out-of-zone DNAME records for CNAME synthesis
        * Fix invalid HTTP content length/chunk size checks and RR rdata           field length validation in zone transfer, preventing heap           buffer-overflow read errors
        * Fix defense in depth for service callback with empty packet
        * Fix shared memory statistics with threads
        * Fix EDNS client subnet to not store SERVFAIL in the global cache           after a failed lookup; stores a short-lived failure entry in the           subnet cache instead
        * Fix memory corruption related core dumps when alloc_reg_obtain           encounters an empty list
        * Fix RFC 7766 compliance when client sends EOF over TCP
        * Fix DoH session cleanup when the same query appears on multiple           streams
        * Fix TLS context setup for tls-service-pem
        * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values
        * Fix memory leak in subnet SERVFAIL store
        * Fix for the Jiggle Attack: server now answers errors for error           cases and no longer reflects parts of the incoming query
        * Fix EDNS extended RCODE reflection: server no longer echoes           extended RCODE values after CHAOS class queries
        * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN           answers that contain a DNAME record
        * Fix missing bounds check when decompressing dnames for downloaded           authority zones, preventing malformed content from truncated AXFR           packets
        * Fix upstream TLS connections being reused for different names at           the same IP address
        * Fix to disallow signatures with revoked DNSKEYs
        * Fix DNAME with unsigned CNAME to check for the correct match,           preventing certain zone configurations from granting secure status           to unchecked CNAMEs
        * Fix wildcard CNAME handling in the chain of trust
        * Fix buffer overrun in doq_repinfo_retrieve_localaddr()
      - Packaging changes:
        * Update keyring to new NLnet Labs release signing key

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3170ee6a1c advisory.

    Update to 1.25.2 (rhbz#2506061)

    Security fixes:

    - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC     environments. Thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University, for the report.
    - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass. Thanks to     N0zoM1z0 (https://github.com/N0zoM1z0) for the report. In addition, thanks to Kunta Chu, Kaihua Wang, and     Jianjun Chen from Tsinghua University, for also reporting this issue. In addition, thanks to Qifan Zhang,     Palo Alto Networks, for also reporting this issue. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks to Qifan Zhang, Palo Alto Networks,     for the report. In addition, thanks to Trung Nguyen (@everping) of CyStack, for also reporting this issue.
    - Fix CVE-2026-41637, Degradation of resolution service from improperly accounted client-terminated DNS-     over-QUIC queries. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a     one-time 'ghost domain' delegation renewal via glue records. Thanks to Qifan Zhang, Palo Alto Networks,     for the report.
    - Fix CVE-2026-44621, Libunbound applications configured with 'unwanted-reply-threshold' could eventually     be abruptly terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by     a legitimate parent's NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via RRSIG.labels manipulation. Thanks to Qifan     Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-46582, A wildcard replay, as another piece of data, triggers poisoning in the serve expired     reply path. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation restarts. Thanks to Kunjie Shang,     University of Science and Technology of China, for the report.
    - Fix CVE-2026-50046, Possible heap use-after-free in an error path when a DoT forwarded query is jostled     out. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL. Thanks     to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for XFR in auth/rpz zones. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50251, Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50252, Possible cache poisoning attack by mapping source port population per thread. Thanks     to Inbal Schussheim and Amit Klein, Hebrew University, for the report.
    - Fix CVE-2026-52863, Memory corruption could lead to crash and denial of service. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-54478, DNS Cookie bypass when combined with proxy-protocol use. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55708, Privacy/configuration issue when adding local data in views through 'unbound-     control'. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a     crash. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin Wang, Jiapeng     Li, and Jiajia Liu, Northwestern Polytechnical University, for also reporting this issue.
    - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured Unbound. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2. Thanks to     Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-56416, Possible heap buffer overflow when validator canonicalizes RDATA that contains     domain name. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-56444, Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-     timeout' are combined in unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for     also reporting this issue. In addition, thanks to Haruki Oyama (Waseda University), for also reporting     this issue.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
330825	Fedora 44 : unbound (2026-e495bd59ef)	Nessus	Fedora Local Security Checks	7/30/2026	7/30/2026	high
329664	Linux Distros Unpatched Vulnerability : CVE-2026-55991	Nessus	Misc.	7/25/2026	9/3/2026	medium
330007	FreeBSD : unbound -- multiple vulnerabilities (f63b4b88-6901-4c12-b13d-5a821e25e9bf)	Nessus	FreeBSD Local Security Checks	7/26/2026	7/27/2026	high
333040	Photon OS 5.0: Unbound PHSA-2026-5.0-92-0943	Nessus	PhotonOS Local Security Checks	8/6/2026	8/12/2026	high
335078	openSUSE 16: libunbound8 / python3-unbound / unbound / unbound-anchor / etc (openSUSE-SU-2026:21550-1)	Nessus	SuSE Local Security Checks	8/13/2026	9/1/2026	high
331344	Fedora 43 : unbound (2026-3170ee6a1c)	Nessus	Fedora Local Security Checks	7/31/2026	7/31/2026	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

high