Ghost Domain Names Vulnerability in Unbound by NLnet Labs
CVE-2026-42955

3.7LOW

Key Information:

Vendor

Nlnet Labs

Status
Unbound
Vendor
CVE Published:
22 July 2026

What is CVE-2026-42955?

A vulnerability in NLnet Labs Unbound versions 1.16.2 to 1.25.1 allows attackers to exploit 'ghost domain names' by extending the ghost domain window using cached TTL values for A/AAAA glue records. When controlled by an attacker, a single client query can cause Unbound to overwrite existing cached data, resulting in extended exposure to ghost domain attacks. In configurations where 'harden-referral-path: yes' is enabled, the impact can occur without any client query, as Unbound automatically performs the necessary query. This presents significant risks for DNS service integrity.

Affected Version(s)

Unbound 1.16.2 < 1.25.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955...
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang (Palo Alto Networks)
.