Unbound DNS EUVD-2026-31080

Two conditions must be met for default-configuration exploitation: first, the adversary must control a ghost zone - a domain whose parent-level delegation has expired at the registry or registrar level while the child-side authoritative DNS infrastructure remains operational under adversary control; second, the adversary must be able to send at least one NS query to the target Unbound resolver, which requires network-level reachability to the resolver. In the non-default configuration where 'harden-referral-path: yes' is explicitly set, the second condition is eliminated - Unbound itself issues the triggering NS query as part of its referral path hardening logic, requiring only that the ghost zone is encountered during normal recursive resolution. Exploitation is bounded by the need for adversary zone control (a non-trivial operational prerequisite requiring domain registration or takeover), and by the fact that the vulnerability extends rather than creates a ghost domain window - the domain must already be in an expired delegation state. Per the CVSS vector (PR:N), no authentication to the resolver is required. No special platform, OS, or compile-time flag beyond the 'harden-referral-path' configuration note above is documented as required.

The CVSS 4.0 score of 6.6 reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with a high integrity impact on DNS resolution (VI:H) and no direct confidentiality or availability impact. The Exploit Maturity modifier E:U ('Unreported') and the absence of a CISA KEV listing both indicate no confirmed active exploitation at time of analysis; no public proof-of-concept code is known. EPSS data was not provided in the source intelligence. Despite the CVSS base score of 6.6 appearing moderate, the real-world risk is material for any organization using Unbound as a recursive resolver where DNS integrity is operationally critical, since ghost domain persistence can redirect clients to attacker-controlled infrastructure for an extended period. A notable discrepancy: the vulnerability tag supplied is 'Information Disclosure', which does not align with the CVSS impact metrics (VC:N, VI:H, VA:N); the primary confirmed impact is DNS integrity compromise, though ghost domain redirection can indirectly expose DNS query traffic and client activity to attacker-controlled authoritative servers, which may explain the tag. The 'Amber' urgency rating in the CVSS supplemental metadata suggests the vendor considers this important but not emergency-level. The prerequisite of adversary zone control meaningfully constrains opportunistic mass exploitation compared to vulnerabilities with no such prerequisite.

An attacker registers or otherwise gains operational control of a ghost zone - a domain whose parent-level delegation (at the registry or registrar) has expired but whose child-side authoritative DNS servers remain active and under attacker control. The attacker sends a single NS query for that zone to a vulnerable Unbound resolver reachable over the network; Unbound fetches the child-side apex NS rrset and incorrectly uses it to overwrite the stale parent-side referral in its cache, resetting the effective TTL up to the 'cache-max-ttl' value. DNS clients querying Unbound subsequently resolve the expired domain to attacker-controlled IP addresses for the duration of the extended TTL. On resolvers configured with 'harden-referral-path: yes', no explicit attacker-sent query is required - Unbound's own referral hardening mechanism internally issues the triggering NS lookup, making exploitation entirely passive from the network perspective once the ghost zone is established.