NLnet Labs Unbound CVE-2026-42955

The attacker must control a ghost DNS zone - a domain whose parent-zone NS delegation has expired or been removed - and must either (a) be able to send A/AAAA queries to the targeted Unbound resolver directly or through a client, or (b) target a resolver running the non-default harden-referral-path: yes configuration, in which case no query is required because Unbound performs the lookup implicitly. Exploitation is blocked by strict ACL policies on the resolver (access-control directives that deny queries from untrusted sources) and by prompt expiry of cached glue records in patched versions. The exploit requires a specific timing window where the parent-side glue has expired locally but the ghost zone infrastructure remains reachable. Authentication is not required per the PR:N CVSS metric, but zone control is a significant non-trivial precondition.

The NVD CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained real-world risk. AC:H captures the meaningful prerequisite of controlling a ghost DNS zone, which is a non-trivial operational requirement. The impact is limited to DNS integrity (I:L) - no confidentiality exposure and no availability disruption. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified. No CISA KEV listing exists and no POC has been reported, making current exploitation unlikely at scale. The harden-referral-path: yes configuration creates a worse-case scenario (passive exploitation, no client trigger) but is explicitly non-default, limiting blast radius to intentionally hardened deployments. The primary real-world risk is targeted DNS cache manipulation in scenarios where an adversary has already established control of a lapsed or ghost domain - a precondition that materially limits opportunistic exploitation compared to the raw network-reachable CVSS surface.

An adversary registers or takes control of a ghost domain (one whose parent-zone delegation has been withdrawn) and issues a crafted A/AAAA query to a vulnerable Unbound resolver that previously cached referral data for that domain. The resolver overwrites its internally cached but expired parent-side glue record with a refreshed TTL, causing subsequent queries from legitimate clients to receive stale or adversary-influenced DNS responses for up to one additional cache-max-ttl period. On resolvers configured with harden-referral-path: yes, the adversary does not even need to submit a client query - Unbound's implicit A/AAAA lookup during referral path hardening performs the overwrite automatically. No POC has been identified.