CVE-2026-42955

Published: Lug 22, 2026 Last Modified: Lug 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.

672

Operation on a Resource after Expiration or Release

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Other Availability
Potential Impacts:
Modify Application Data Read Application Data Other Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Mobile
View CWE Details
Application

Unbound by Nlnetlabs

Product Information
Vendor Nlnetlabs
Product Unbound
Version Range Affected
From 1.16.2 (inclusive)
To 1.25.2 (exclusive)
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.t…
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt