NLnet Labs Unbound up to 1.25.0 config

Summaryinfo

A vulnerability classified as problematic has been found in NLnet Labs Unbound up to 1.25.0. Impacted is an unknown function. The manipulation leads to config. This vulnerability is listed as CVE-2026-40622. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in NLnet Labs Unbound up to 1.25.0. This issue affects some unknown processing. The manipulation with an unknown input leads to a config vulnerability. Using CWE to declare the problem leads to CWE-16. Impacted is integrity. The summary by CVE is:

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

The weakness was presented by Qifan Zhang. The advisory is shared at nlnetlabs.nl. The identification of this vulnerability is CVE-2026-40622 since 05/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592.004 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 315764 (Linux Distros Unpatched Vulnerability : CVE-2026-40622), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315764) and CERT Bund (WID-SEC-2026-1599). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Open Source Unbound
• cPanel cPanel/WHM

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion