CVE-2026-42955
Received Received - Intake

Ghost Domain Name Cache Poisoning in Unbound DNS

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-42955
EUVD
EUVD-2026-47666

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-42955 is a vulnerability in NLnet Labs Unbound DNS software versions 1.16.2 to 1.25.1. It allows an attacker to extend the 'ghost domain window' by up to one cached TTL value for A/AAAA glue records. This is part of the 'ghost domain names' attack family, where an adversary controls a ghost zone and queries a vulnerable Unbound instance. The issue enables the attacker to overwrite cached expired parent-side glue records, extending the window for malicious domain impersonation.

Detection Guidance

To detect this vulnerability, check if your Unbound version is between 1.16.2 and 1.25.1. Run 'unbound -V' to see the installed version. If vulnerable, monitor DNS logs for unusual A/AAAA record caching behavior or ghost domain queries.

Impact Analysis

This vulnerability could allow an attacker to trick your DNS resolver into caching malicious domain records for longer than intended. This might lead to users being redirected to fake websites, intercepting sensitive data like login credentials or financial information. It could also enable phishing attacks or malware distribution by maintaining control over hijacked domains for extended periods.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it primarily impacts DNS resolution integrity rather than data protection or privacy controls. However, organizations using vulnerable Unbound versions may face indirect compliance risks if DNS spoofing or cache poisoning leads to unauthorized data exposure or service disruption.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or later immediately. If upgrading is not possible, apply the patch manually as described in the official advisory. Disable 'harden-referral-path: yes' if enabled, as it bypasses client query requirements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart