EUVD-2026-47666
GHSA-2pwm-327c-rq4r
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H reflects mandatory ghost zone control; I:L captures DNS resolution integrity corruption; C:N and A:N as no data disclosure or service disruption occurs.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.
AnalysisAI
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Technical ContextAI
CWE-672 ('Operation on a Resource after Expiration or Release') captures the root cause: Unbound operates on DNS cache entries - specifically parent-side A/AAAA glue records - after those entries have logically expired, refreshing their TTL rather than discarding them. The ghost domain attack family exploits the gap between when a domain's delegation is withdrawn at the parent zone and when downstream resolvers expire their cached referral data. This variant specifically targets the A/AAAA glue record path, which CVE-2026-40622's fix left unaddressed (that fix only covered NS queries). The affected CPE is cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* for versions 1.16.2 to 1.25.1. Unbound is a validating, recursive, caching DNS resolver developed by NLnet Labs and is widely deployed as a security-hardened alternative to BIND.
RemediationAI
Administrators should consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt for the exact patched release and upgrade Unbound to the version specified therein; an exact fix version was not independently confirmed from the provided intelligence and should be verified directly from the vendor. Where immediate patching is not feasible, restrict recursive query access to trusted clients only using Unbound's access-control directive - this prevents adversary-controlled clients from submitting the A/AAAA queries that trigger the cache overwrite. If harden-referral-path: yes is configured, reverting to the default (no) eliminates the passive exploitation path at the cost of reduced referral path hardening, which is a trade-off that may be acceptable in low-risk environments. Rate-limiting or blocking queries referencing known ghost or recently-expired domains via RPZ (Response Policy Zones) can also reduce exposure with minimal service impact.
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today