Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NLnet Labs：Unbound （包括版本 1.25.0 ）很容易透過權威部分的混雜記錄而中毒。在權限區段中補充 DNS 回覆的混雜 RRS 集可用來誘騙 Unbound 快取此類記錄。如果攻擊者能夠在回覆中附加此類記錄（即欺騙封包、片段攻擊），他將能夠毒害 Unbound 的快取。惡意執行者可插入 NS 以外的 RRSet，這些 RRSet 在回覆中也隨附位址記錄，例如 MX，藉此利用可能的毒害。這可以透過嘗試欺騙回覆封包或片段化攻擊來實現。然後，Unbound 會接受附加區段中的相對位址記錄，並在授權單位 RRSet 此時具有足夠的信任 （亦即委派點的區域內資料） 時快取它們。Unbound 1.25.1 包含一個修補程式，如果地址記錄不明確地僅與授權單位 NS 記錄相關，則會忽略附加區段中的地址記錄，從而減輕可能的毒害效應。這是對 CVE-2025-11411的補充修正。（CVE-2026-42960）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程 Ubuntu 22.04 LTS/24.04 LTS/25.10/26.04 LTS 主机上安装的多个程序包受到 USN-8282-1 公告中提及的多个漏洞影响。

    Andrew Griffiths 发现，Unbound 未能正确处理某些 DNSCrypt 数据包。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务。
    (CVE-2026-32792)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理 DNSSEC 验证。远程攻击者可能利用此问题执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-33278)

    Qifan Zhang 发现，Unbound 未能正确处理某些 ghost 域名记录。远程攻击者可能利用此问题造成拒绝服务。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-40622)

    Qifan Zhang 发现，Unbound 未能正确限制长 EDNS 选项列表的处理操作。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-41292)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理推挤逻辑。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-42534)

    Qifan Zhang 发现，Unbound 未能正确绑定 NSEC3 哈希计算。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。
    (CVE-2026-42923)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理多个 EDNS 选项。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务或执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。
    (CVE-2026-42944)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理恶意内容的 DNSSEC 验证。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo 和 JianJun Chen 发现，Unbound 在某些情况下未能正确处理委派处理操作。远程攻击者可能会利用此问题造成 DNS 缓存中毒并获取敏感信息。(CVE-2026-42960)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确绑定名称压缩。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-44390)

    Qifan Zhang 发现，Unbound 在处理 RPZ 期间存在一个释放后使用问题。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务或执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-44608)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - NLnet Labs Unbound 及之前版本（含）容易 1.25.0 受到通过权限部分的混杂记录造成的毒害的影响。可利用与颁发机构部分中的 DNS 回复相补的混杂 RRSet 诱骗 Unbound 缓存此类记录。如果攻击者能够在回复中附加此类记录（即欺骗数据包、碎片攻击），则能够使 Unbound 的缓存中毒。恶意执行者可通过注入 NS 以外的回复中还附有地址记录的 RRSet（例如 MX）来利用可能的毒性影响。这可通过尝试欺骗回复数据包或碎片攻击来实现。然后，如果颁发机构 RRSet 此时具有足够的信任（即委派点的区域内数据），则 Unbound 将接受附加部分中的相对地址记录并对其进行缓存。Unbound 1.25.1 包含一个包含一个修复程序的修补程序，如果来自附加部分的地址记录不是明确地仅与颁发机构 NS 记录相关，则会将其忽略，从而缓解可能的中毒影响。这是对 CVE-2025-11411的补充补丁。（CVE-2026-42960）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端 Ubuntu 22.04 LTS/24.04 LTS/25.10/26.04 LTS 主機上安裝的多個套件受到 USN-8282-1 公告中提及的多個弱點影響。

    Andrew Griffiths 發現 Unbound 未正確處理某些 DNSCrypt 封包。遠端攻擊者可能利用此問題造成 Unbound 損毀，進而導致拒絕服務。
    (CVE-2026-32792)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了 DNSSEC 驗證。遠端攻擊者可能會利用此問題執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-33278)

    張奇帆發現，Unbound 對某些幽靈網域記錄的處理方式不正確。遠端攻擊者可能利用此問題引發拒絕服務。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-40622)

    Qifan Zhang 發現 Unbound 沒有正確限制長 EDNS 選項清單的處理。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-41292)

    張奇凡發現，Unbound 在某些情況下對推擠邏輯的處理方式是錯誤的。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-42534)

    Qifan Zhang 發現 Unbound 沒有正確綁定 NSEC3 雜湊計算。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。
    (CVE-2026-42923)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了多個 EDNS 選項。遠端攻擊者可利用此問題造成 Unbound 當機，進而引發拒絕服務或可能執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 LTS 和 Ubuntu 26.04 LTS。
    (CVE-2026-42944)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了 DNSSEC 惡意驗證內容。遠端攻擊者可能利用此問題造成 Unbound 損毀，進而導致拒絕服務。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo 和 Jianjun Chen 發現 Unbound 在某些情況下錯誤地處理委派處理。遠端攻擊者可能利用此漏洞進行 DNS 快取中毒攻擊，並取得敏感資訊。(CVE-2026-42960)

    Qifan Zhang 發現，在某些情況下，Unbound 未能正確地對名稱壓縮進行綁定。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-44390)

    Qifan Zhang 發現 Unbound 在 RPZ 處理中存在釋放後使用問題。遠端攻擊者可利用此問題造成 Unbound 當機，進而引發拒絕服務或可能執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-44608)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - バージョン 1.25.0 までの NLnet Labs Unbound は、権限セクションの乱雑なレコードを通じたポイズニングに対して脆弱です。権限セクションで DNS 応答を補完する無造作な RRSet を利用して、Unbound がこのようなレコードをキャッシュするように騙す可能性があります。敵対者がそのようなレコードを返信に添付できる場合(つまり、偽装パケット、フラグメンテーション攻撃)、Unbound のキャッシュをポイズニングする可能性があります。悪意のある攻撃者が、例えば MX などの返信にアドレスレコードを伴う NS 以外の RRSet を注入することで、起こり得る有害な影響を悪用する可能性があります。これは、返信パケットの偽装を試みるか、フラグメンテーション攻撃を行うことで実現される可能性があります。その後、Unbound は追加セクションで相対アドレスレコードを受け入れ、権限 RRSet がこの時点で十分な信頼を持っている場合、つまり委任ポイントのゾーン内データである場合に、これらをキャッシュします。Unbound 1.25.1 には、権限 NS レコードのみに明示的に関連していない場合、追加セクションのアドレスレコードを無視する修正を含むパッチが含まれており、潜在的なポイズニング効果が緩和されています。これは、 CVE-2025-11411 を補完する修正です。(CVE-2026-42960)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートの Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS ホストには、USN-8282-1 アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    Andrew Griffiths 氏は、Unbound が特定の DNSCrypt パケットを適切に処理していないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-32792)

    Qifan Zhang 氏は、特定の状況で Unbound が DNSSEC 検証を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して、任意のコードを実行する可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-33278)

    Qifan Zhang 氏は、Unbound が特定のゴーストドメイン名レコードを不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用し、サービス拒否を引き起こす可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-40622)

    Qifan Zhang 氏は、Unbound が長い EDNS オプションリストの処理を適切に制限していないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-41292)

    Qifan Zhang 氏は、Unbound が特定の状況下で jostle ロジックを不適切に処理していることを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-42534)

    Qifan Zhang 氏は、Unbound が NSEC3 ハッシュ計算を適切にバインドしていないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-42923)

    Qifan Zhang 氏は、特定の状況で Unbound が複数の EDNS オプションを不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS および Ubuntu 26.04 LTS にのみ影響を与えます。
    (CVE-2026-42944)

    Qifan Zhang 氏は、Unbound が悪意のあるコンテンツの DNSSEC 検証を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo、JianJun Chen の各氏は、特定の状況で Unbound が委譲処理を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して、DNS キャッシュを汚染して秘密情報を取得する可能性があります。(CVE-2026-42960)

    Qifan Zhang 氏は、Unbound が特定の状況で名前圧縮を適切にバインドしていないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-44390)

    Qifan Zhang 氏は、Unbound に RPZ 処理のメモリ解放後使用 (use-after-free) の問題があることを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-44608)

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8282-1 advisory.

    Andrew Griffiths discovered that Unbound did not properly handle certain DNSCrypt packets. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-32792)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation in certain situations. A remote     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-33278)

    Qifan Zhang discovered that Unbound incorrectly handled certain ghost domain name records. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-40622)

    Qifan Zhang discovered that Unbound did not properly limit processing of long EDNS option lists. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-41292)

    Qifan Zhang discovered that Unbound incorrectly handled jostle logic under certain circumstances. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-42534)

    Qifan Zhang discovered that Unbound did not properly bound NSEC3 hash calculations. A remote attacker     could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of service.
    (CVE-2026-42923)

    Qifan Zhang discovered that Unbound incorrectly handled multiple EDNS options in certain situations. A     remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service,     or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-42944)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation of malicious content. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-42959)

    TaoFei Guo, Yang Luo, and JianJun Chen discovered that Unbound incorrectly handled delegation processing     in certain situations. A remote attacker could possibly use this issue to poison the DNS cache and obtain     sensitive information. (CVE-2026-42960)

    Qifan Zhang discovered that Unbound did not properly bound name compression in certain cases. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-44390)

    Qifan Zhang discovered that Unbound had a use-after-free issue in RPZ handling. A remote attacker could     possibly use this issue to cause Unbound to crash, resulting in a denial of service, or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-49f37e16aa advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

    ----

    # Update to 1.25.0 (rhbz#2463781)

    ## Feature changes:

    - Improved TTL 0 handling
    - Reload also certificates on reload if they have changed
    - Allow control-interface specification also of port.
    - Added new tls-protocols option. Can disable TLS 1.2 explicitly.

    And bug fixes.

    Remove merged patches.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1756 advisory.

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust. (CVE-2026-40622)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100). (CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could     defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age     of slow running queries and not allow the jostle logic to see them as aged and potential targets for     replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain     name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and     degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,     the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to     resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need     resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the     original one that started the resolution effort. Cache and local data response performance remains     unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1     contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow     the jostle logic to work as intended. (CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where     the code path to consult the negative cache for DS records does not take into account the limit on NSEC3     hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An     adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably     high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the     allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in     1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the     hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise     the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable     code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap     overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply     packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for     the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by     attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the     size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the     available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data     and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a     fix to prevent truncation of the EDNS field size calculation. (CVE-2026-42944)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets. (CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508. (CVE-2026-44390)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability     that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-     nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the     vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with     'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the     vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read     that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free     objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with     a fix to the locking code. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315763	Linux Distros 未修補的弱點：CVE-2026-42960	Nessus	Misc.	2026/5/20	2026/5/26	high
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS：Unbound 漏洞 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
315763	Linux Distros 未修补的漏洞：CVE-2026-42960	Nessus	Misc.	2026/5/20	2026/5/26	high
316076	Ubuntu 22.04 LTS/24.04 LTS/25.10/ 26.04 LTS：Unbound 弱點 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
315763	Linux Distros のパッチ未適用の脆弱性: CVE-2026-42960	Nessus	Misc.	2026/5/20	2026/5/26	high
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound の脆弱性 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound vulnerabilities (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
316993	Fedora 44 : unbound (2026-49f37e16aa)	Nessus	Fedora Local Security Checks	2026/5/27	2026/5/27	critical
316916	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-1756)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	critical
315763	Linux Distros Unpatched Vulnerability : CVE-2026-42960	Nessus	Misc.	2026/5/20	2026/5/26	high

检测

插件搜索

high

critical

high

critical

high

critical

critical

critical

critical

high