According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411.(CVE-2026-42960)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100).(CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets.(CVE-2026-42959)

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure.(CVE-2026-33278)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets.(CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411.(CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100).(CVE-2026-41292)

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure.(CVE-2026-33278)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508.(CVE-2026-44390)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where     the code path to consult the negative cache for DS records does not take into account the limit on NSEC3     hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An     adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably     high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the     allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in     1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the     hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise     the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable     code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)

    NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when     compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's     DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the     vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00'     bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than     necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory     layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low,     since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow     does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with     a fix to bound reading in the given buffer space.(CVE-2026-32792)

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure.(CVE-2026-33278)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411.(CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could     defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age     of slow running queries and not allow the jostle logic to see them as aged and potential targets for     replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain     name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and     degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,     the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to     resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need     resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the     original one that started the resolution effort. Cache and local data response performance remains     unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1     contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow     the jostle logic to work as intended.(CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets.(CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100).(CVE-2026-41292)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0887 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-40622:
    A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain (a ghost     zone) and querying a vulnerable Unbound server, could exploit a vulnerability related to ghost domain     names attacks. This could allow the attacker to overwrite cached Name Server (NS) records, extending the     ghost domain window by up to one cached Time To Live (TTL) value. This manipulation could lead to cache     poisoning, potentially causing the Unbound server to serve incorrect or malicious DNS information.

    CVE-2026-41292:
    A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending queries with an     excessive number of EDNS (Extension Mechanisms for DNS) options. This can cause Unbound threads to be held     hostage while parsing and creating internal data structures for these options. Coordinated attacks can     lead to resource exhaustion, resulting in a degradation of service or a denial of service (DoS) for     legitimate users.

    CVE-2026-42534:
    A flaw was found in Unbound. An adversary who can query a vulnerable Unbound instance and control a slow     or malicious domain name server can exploit a vulnerability in the jostle logic. This flaw allows     retransmitted queries to renew the age of slow-running queries, preventing them from being identified as     aged and replaced. This can degrade Unbound's resolution performance, potentially leading to a denial of     resolution service through coordinated attacks.

    CVE-2026-44390:
    A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending specially crafted     DNS responses containing very large Resource Record Sets (RRsets) that require name compression. This can     cause Unbound to spend a significant amount of time processing these responses, leading to degraded     performance and potentially a denial of service (DoS) for legitimate users.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 72e5b334-6365-11f1-8c57-000af7b98cf6 advisory.

    NLnet Labs reports:
    This release consolidates security fixes for issues reported                 over a period of time. There are fixes for:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the unbound package has been released.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e495bd59ef advisory.

    Update to 1.25.2 (rhbz#2506061)

    Security fixes:

    - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC     environments. Thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University, for the report.
    - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass. Thanks to     N0zoM1z0 (https://github.com/N0zoM1z0) for the report. In addition, thanks to Kunta Chu, Kaihua Wang, and     Jianjun Chen from Tsinghua University, for also reporting this issue. In addition, thanks to Qifan Zhang,     Palo Alto Networks, for also reporting this issue. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks to Qifan Zhang, Palo Alto Networks,     for the report. In addition, thanks to Trung Nguyen (@everping) of CyStack, for also reporting this issue.
    - Fix CVE-2026-41637, Degradation of resolution service from improperly accounted client-terminated DNS-     over-QUIC queries. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a     one-time 'ghost domain' delegation renewal via glue records. Thanks to Qifan Zhang, Palo Alto Networks,     for the report.
    - Fix CVE-2026-44621, Libunbound applications configured with 'unwanted-reply-threshold' could eventually     be abruptly terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by     a legitimate parent's NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via RRSIG.labels manipulation. Thanks to Qifan     Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-46582, A wildcard replay, as another piece of data, triggers poisoning in the serve expired     reply path. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation restarts. Thanks to Kunjie Shang,     University of Science and Technology of China, for the report.
    - Fix CVE-2026-50046, Possible heap use-after-free in an error path when a DoT forwarded query is jostled     out. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL. Thanks     to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for XFR in auth/rpz zones. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50251, Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush. Thanks to     Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-50252, Possible cache poisoning attack by mapping source port population per thread. Thanks     to Inbal Schussheim and Amit Klein, Hebrew University, for the report.
    - Fix CVE-2026-52863, Memory corruption could lead to crash and denial of service. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-54478, DNS Cookie bypass when combined with proxy-protocol use. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55708, Privacy/configuration issue when adding local data in views through 'unbound-     control'. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a     crash. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin Wang, Jiapeng     Li, and Jiajia Liu, Northwestern Polytechnical University, for also reporting this issue.
    - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow. Thanks to Qifan Zhang,     Palo Alto Networks, for the report.
    - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured Unbound. Thanks to Qifan Zhang, Palo     Alto Networks, for the report.
    - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2. Thanks to     Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xuanchao Xie, for also reporting     this issue.
    - Fix CVE-2026-56416, Possible heap buffer overflow when validator canonicalizes RDATA that contains     domain name. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix CVE-2026-56444, Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-     timeout' are combined in unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for     also reporting this issue. In addition, thanks to Haruki Oyama (Waseda University), for also reporting     this issue.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
326138	EulerOS 2.0 SP12 : unbound (EulerOS-SA-2026-2634)	Nessus	Huawei Local Security Checks	2026/7/10	2026/9/14	critical
326638	EulerOS 2.0 SP10 : unbound (EulerOS-SA-2026-2676)	Nessus	Huawei Local Security Checks	2026/7/14	2026/9/14	critical
332885	EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-3004)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/31	critical
340978	TencentOS Server 3: unbound (TSSA-2026:0887)	Nessus	Tencent Local Security Checks	2026/8/26	2026/8/26	high
320011	FreeBSD : Unbound -- Multiple vulnerabilities (72e5b334-6365-11f1-8c57-000af7b98cf6)	Nessus	FreeBSD Local Security Checks	2026/6/9	2026/6/9	critical
318595	Photon OS 4.0: Unbound PHSA-2026-4.0-1027	Nessus	PhotonOS Local Security Checks	2026/6/4	2026/6/21	critical
330825	Fedora 44 : unbound (2026-e495bd59ef)	Nessus	Fedora Local Security Checks	2026/7/30	2026/7/30	high

检测

插件搜索

critical

critical

critical

high

critical

critical

high