Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - NLnet Labs Unbound （包括版本 1.25.0 ） 在處理具有 Unbound 需要執行名稱壓縮的非常大的 RR 集的回覆時，存在弱點。具有非常大的 RRset 的惡意上游回應，其記錄不在根目錄上方共用尾碼，可能會導致 Unbound 花費大量時間將名稱壓縮套用至下游回覆。這可導致效能降低，並最終在精心策劃的攻擊中造成拒絕服務。攻擊者可以藉由查詢 Unbound 以取得具有非常大的 RRset 的惡意區域特製內容，藉此來利用弱點。在 Unbound 回覆查詢之前，它會嘗試套用名稱壓縮。名稱壓縮是一種會鎖定 CPU 的無限製作業，直到完成整個封包為止。為此引入 1.21.1 了壓縮限制，但它沒有考慮到記錄不會在根目錄上方共享任何尾碼的情況。這會導致 Unbound 由於壓縮樹狀結構查詢失敗而進入不同的程式碼路徑，並且最終不會遞增這些作業的壓縮計數器。Unbound 1.25.1 包含一個修補程式，其修正程式會遞增壓縮計數器，而不論壓縮樹狀結構查詢為何。這是對 CVE-2024-8508的補充修正。（CVE-2026-44390）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程 Ubuntu 22.04 LTS/24.04 LTS/25.10/26.04 LTS 主机上安装的多个程序包受到 USN-8282-1 公告中提及的多个漏洞影响。

    Andrew Griffiths 发现，Unbound 未能正确处理某些 DNSCrypt 数据包。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务。
    (CVE-2026-32792)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理 DNSSEC 验证。远程攻击者可能利用此问题执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-33278)

    Qifan Zhang 发现，Unbound 未能正确处理某些 ghost 域名记录。远程攻击者可能利用此问题造成拒绝服务。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-40622)

    Qifan Zhang 发现，Unbound 未能正确限制长 EDNS 选项列表的处理操作。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-41292)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理推挤逻辑。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-42534)

    Qifan Zhang 发现，Unbound 未能正确绑定 NSEC3 哈希计算。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。
    (CVE-2026-42923)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理多个 EDNS 选项。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务或执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。
    (CVE-2026-42944)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确处理恶意内容的 DNSSEC 验证。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo 和 JianJun Chen 发现，Unbound 在某些情况下未能正确处理委派处理操作。远程攻击者可能会利用此问题造成 DNS 缓存中毒并获取敏感信息。(CVE-2026-42960)

    Qifan Zhang 发现，Unbound 在某些情况下未能正确绑定名称压缩。远程攻击者可能会利用此问题造成 Unbound 使用过多资源，从而导致拒绝服务。(CVE-2026-44390)

    Qifan Zhang 发现，Unbound 在处理 RPZ 期间存在一个释放后使用问题。远程攻击者可能利用此问题造成 Unbound 崩溃，从而导致拒绝服务或执行任意代码。此问题仅影响 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-44608)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 处理包含 Unbound 需要为其执行名称压缩的非常大的 RRset 的回复时，NLnet Labs Unbound 及其之前的版本 1.25.0 存在一个漏洞。具有大型 RRset（且记录不共享 root 以上后缀）的恶意上游响应可造成 Unbound 花费大量时间将名称压缩应用于下游回复。这会导致性能下降，并最终在编排的攻击中发生拒绝服务。攻击者可通过向 Unbound 查询具有极大 RRset 的恶意区域的特制内容，以利用此漏洞。Unbound 在回复查询之前，会尝试应用名称压缩，这是一种未绑定的操作，可能会锁定 CPU，直到整个数据包完成为止。虽然引入了压缩限制 1.21.1 ，但未考虑记录不会共享根以上任何后缀的情况。这会造成 Unbound 因压缩树查找失败而进入不同的代码路径，并且最终无法增加这些操作的压缩计数器。Unbound 1.25.1 包含一个包含一个补丁的修补程序，无论如何查找压缩树，该补丁都会增加压缩计数器。这是对 CVE-2024-8508的补充补丁。（CVE-2026-44390）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端 Ubuntu 22.04 LTS/24.04 LTS/25.10/26.04 LTS 主機上安裝的多個套件受到 USN-8282-1 公告中提及的多個弱點影響。

    Andrew Griffiths 發現 Unbound 未正確處理某些 DNSCrypt 封包。遠端攻擊者可能利用此問題造成 Unbound 損毀，進而導致拒絕服務。
    (CVE-2026-32792)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了 DNSSEC 驗證。遠端攻擊者可能會利用此問題執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-33278)

    張奇帆發現，Unbound 對某些幽靈網域記錄的處理方式不正確。遠端攻擊者可能利用此問題引發拒絕服務。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-40622)

    Qifan Zhang 發現 Unbound 沒有正確限制長 EDNS 選項清單的處理。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-41292)

    張奇凡發現，Unbound 在某些情況下對推擠邏輯的處理方式是錯誤的。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-42534)

    Qifan Zhang 發現 Unbound 沒有正確綁定 NSEC3 雜湊計算。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。
    (CVE-2026-42923)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了多個 EDNS 選項。遠端攻擊者可利用此問題造成 Unbound 當機，進而引發拒絕服務或可能執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 LTS 和 Ubuntu 26.04 LTS。
    (CVE-2026-42944)

    Qifan Zhang 發現 Unbound 在某些情況下錯誤地處理了 DNSSEC 惡意驗證內容。遠端攻擊者可能利用此問題造成 Unbound 損毀，進而導致拒絕服務。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo 和 Jianjun Chen 發現 Unbound 在某些情況下錯誤地處理委派處理。遠端攻擊者可能利用此漏洞進行 DNS 快取中毒攻擊，並取得敏感資訊。(CVE-2026-42960)

    Qifan Zhang 發現，在某些情況下，Unbound 未能正確地對名稱壓縮進行綁定。遠端攻擊者可能利用此漏洞，導致 Unbound 消耗過多資源，進而引發拒絕服務。(CVE-2026-44390)

    Qifan Zhang 發現 Unbound 在 RPZ 處理中存在釋放後使用問題。遠端攻擊者可利用此問題造成 Unbound 當機，進而引發拒絕服務或可能執行任意程式碼。受此問題影響的只有 Ubuntu 24.04 LTS、Ubuntu 25.10 和 Ubuntu 26.04 LTS。(CVE-2026-44608)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS ホストには、USN-8282-1 アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    Andrew Griffiths 氏は、Unbound が特定の DNSCrypt パケットを適切に処理していないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-32792)

    Qifan Zhang 氏は、特定の状況で Unbound が DNSSEC 検証を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して、任意のコードを実行する可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-33278)

    Qifan Zhang 氏は、Unbound が特定のゴーストドメイン名レコードを不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用し、サービス拒否を引き起こす可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-40622)

    Qifan Zhang 氏は、Unbound が長い EDNS オプションリストの処理を適切に制限していないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-41292)

    Qifan Zhang 氏は、Unbound が特定の状況下で jostle ロジックを不適切に処理していることを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-42534)

    Qifan Zhang 氏は、Unbound が NSEC3 ハッシュ計算を適切にバインドしていないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-42923)

    Qifan Zhang 氏は、特定の状況で Unbound が複数の EDNS オプションを不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS および Ubuntu 26.04 LTS にのみ影響を与えます。
    (CVE-2026-42944)

    Qifan Zhang 氏は、Unbound が悪意のあるコンテンツの DNSSEC 検証を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こす可能性があります。
    (CVE-2026-42959)

    TaoFei Guo、Yang Luo、JianJun Chen の各氏は、特定の状況で Unbound が委譲処理を不適切に処理することを発見しました。リモートの攻撃者がこの問題を悪用して、DNS キャッシュを汚染して秘密情報を取得する可能性があります。(CVE-2026-42960)

    Qifan Zhang 氏は、Unbound が特定の状況で名前圧縮を適切にバインドしていないことを発見しました。リモートの攻撃者がこの問題を悪用して Unbound にリソースを過剰に利用させ、サービス拒否を引き起こす可能性があります。(CVE-2026-44390)

    Qifan Zhang 氏は、Unbound に RPZ 処理のメモリ解放後使用 (use-after-free) の問題があることを発見しました。リモートの攻撃者がこの問題を悪用して Unbound をクラッシュさせ、サービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。この問題は、Ubuntu 24.04 LTS、Ubuntu 25.10 LTS、および Ubuntu 26.04 LTS にのみ影響を与えます。(CVE-2026-44608)

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - バージョン 1.25.0 までの NLnet Labs Unbound には、Unbound が名前圧縮を実行する必要がある非常に大きな RRset を含む返信を処理する際に脆弱性があります。root より上の接尾辞を共有しないレコードを伴う非常に大きな RRset を使用した悪意のあるアップストリーム応答により、Unbound はダウンストリームの返信に対する名前圧縮の適用にかなりの時間を費やす可能性があります。これにより、オーケストレーションされた攻撃でパフォーマンスが低下し、最終的にサービス拒否が発生する可能性があります。攻撃者が非常に大きなRRRsetを持つ悪意のあるゾーンの特別に細工されたコンテンツについてUnboundをクエリすることで、この脆弱性を悪用する可能性があります。Unbound は、クエリに応答する前に、名前圧縮を適用しようとします。これは際限のない操作であり、パケット全体が完了するまで CPU をロックする可能性があります。このために 1.21.1 で圧縮制限が導入されましたが、レコードがルートより上の接尾辞を共有しない場合を考慮していませんでした。これにより、圧縮ツリールックアップの失敗のためにUnboundが別のコードパスに移動し、最終的にこれらの操作の圧縮カウンターを増加させなくなります。Unbound 1.25.1 には、圧縮ツリーの検索に関係なく圧縮カウンターを増加させる修正が含まれるパッチが含まれています。これは、 CVE-2024-8508 を補完する修正です。(CVE-2026-44390)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8282-1 advisory.

    Andrew Griffiths discovered that Unbound did not properly handle certain DNSCrypt packets. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-32792)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation in certain situations. A remote     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-33278)

    Qifan Zhang discovered that Unbound incorrectly handled certain ghost domain name records. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-40622)

    Qifan Zhang discovered that Unbound did not properly limit processing of long EDNS option lists. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-41292)

    Qifan Zhang discovered that Unbound incorrectly handled jostle logic under certain circumstances. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-42534)

    Qifan Zhang discovered that Unbound did not properly bound NSEC3 hash calculations. A remote attacker     could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of service.
    (CVE-2026-42923)

    Qifan Zhang discovered that Unbound incorrectly handled multiple EDNS options in certain situations. A     remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service,     or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-42944)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation of malicious content. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-42959)

    TaoFei Guo, Yang Luo, and JianJun Chen discovered that Unbound incorrectly handled delegation processing     in certain situations. A remote attacker could possibly use this issue to poison the DNS cache and obtain     sensitive information. (CVE-2026-42960)

    Qifan Zhang discovered that Unbound did not properly bound name compression in certain cases. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-44390)

    Qifan Zhang discovered that Unbound had a use-after-free issue in RPZ handling. A remote attacker could     possibly use this issue to cause Unbound to crash, resulting in a denial of service, or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508. (CVE-2026-44390)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-49f37e16aa advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

    ----

    # Update to 1.25.0 (rhbz#2463781)

    ## Feature changes:

    - Improved TTL 0 handling
    - Reload also certificates on reload if they have changed
    - Allow control-interface specification also of port.
    - Added new tls-protocols option. Can disable TLS 1.2 explicitly.

    And bug fixes.

    Remove merged patches.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1756 advisory.

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust. (CVE-2026-40622)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100). (CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could     defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age     of slow running queries and not allow the jostle logic to see them as aged and potential targets for     replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain     name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and     degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,     the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to     resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need     resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the     original one that started the resolution effort. Cache and local data response performance remains     unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1     contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow     the jostle logic to work as intended. (CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where     the code path to consult the negative cache for DS records does not take into account the limit on NSEC3     hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An     adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably     high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the     allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in     1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the     hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise     the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable     code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap     overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply     packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for     the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by     attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the     size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the     available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data     and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a     fix to prevent truncation of the EDNS field size calculation. (CVE-2026-42944)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets. (CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508. (CVE-2026-44390)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability     that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-     nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the     vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with     'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the     vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read     that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free     objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with     a fix to the locking code. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315778	Linux Distros 未修補的弱點：CVE-2026-44390	Nessus	Misc.	2026/5/20	2026/5/25	medium
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS：Unbound 漏洞 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
315778	Linux Distros 未修补的漏洞：CVE-2026-44390	Nessus	Misc.	2026/5/20	2026/5/25	medium
316076	Ubuntu 22.04 LTS/24.04 LTS/25.10/ 26.04 LTS：Unbound 弱點 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound の脆弱性 (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
315778	Linux Distros のパッチ未適用の脆弱性: CVE-2026-44390	Nessus	Misc.	2026/5/20	2026/5/25	medium
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound vulnerabilities (USN-8282-1)	Nessus	Ubuntu Local Security Checks	2026/5/21	2026/5/21	critical
315778	Linux Distros Unpatched Vulnerability : CVE-2026-44390	Nessus	Misc.	2026/5/20	2026/5/25	medium
316993	Fedora 44 : unbound (2026-49f37e16aa)	Nessus	Fedora Local Security Checks	2026/5/27	2026/5/27	critical
316916	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-1756)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	critical

检测

插件搜索

medium

critical

medium

critical

critical

medium

critical

medium

critical

critical