CVE-2026-42955 in Unbound
Summary
by MITRE • 07/22/2026
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability affects NLnet Labs Unbound DNS resolver versions 1.16.2 through 1.25.1 and represents a sophisticated extension of the ghost domain names attack vector previously documented in CVE-2026-40622. The flaw operates within the DNS caching mechanism where adversarial control over a ghost zone allows manipulation of cached glue records, specifically A and AAAA records that serve as glue for authoritative name servers. The vulnerability exploits the cache-max-ttl configuration parameter to extend the window of opportunity for maintaining ghost domain persistence beyond normal expiration times.
The technical implementation involves the manipulation of cached DNS records where an attacker can cause Unbound to overwrite expired parent-side glue rrsets with fresh data from a malicious zone. This occurs through carefully crafted client queries that target A or AAAA records, allowing the system to extend the ghost domain window by up to the configured cache-max-ttl value. The mechanism relies on the DNS resolver's behavior when processing referrals and maintaining cached information about authoritative servers.
The operational impact extends beyond simple denial of service scenarios to include potential persistent unauthorized access to malicious domains. When 'harden-referral-path: yes' is configured, the vulnerability becomes even more dangerous as no active client query is required for exploitation since Unbound automatically performs the necessary queries internally. This configuration parameter, while providing additional security against certain types of attacks, inadvertently creates a pathway for extended ghost domain persistence in vulnerable installations.
From an ATT&CK framework perspective, this vulnerability maps to techniques involving DNS cache poisoning and persistent threat capabilities within the T1071.004 and T1566 attack patterns. The CWE classification aligns with CWE-200 (Information Exposure) and potentially CWE-345 (Insufficient Verification of Data Authenticity), as the vulnerability involves improper handling of cached DNS data that could expose systems to extended malicious domain control.
Mitigation strategies should focus on updating to patched versions of Unbound, implementing proper zone configuration controls, and monitoring for anomalous DNS query patterns. Administrators should carefully evaluate the use of 'harden-referral-path: yes' configuration in relation to their specific security requirements. Additionally, network segmentation and DNS sinkholing mechanisms can provide defense-in-depth against exploitation attempts. The vulnerability underscores the importance of comprehensive testing of DNS resolver configurations and continuous monitoring for unauthorized zone control scenarios that could enable extended ghost domain persistence.