CVE-2026-40622 affects NLnet Labs Unbound DNS resolver versions 1.16.2 up to and including 1.25.0. The vulnerability belongs to the 'ghost domain names' family, where an attacker controlling a ghost zone can extend the ghost domain window by causing Unbound to overwrite cached expired parent NS referral records with child apex NS records. This extension can last up to one cached TTL value ('cache-max-ttl'). When 'harden-referral-path' is enabled, Unbound performs implicit queries that trigger this behavior without client interaction. The issue is fixed in Unbound 1.25.1 by disallowing TTL extension for parent NS records regardless of their trust level.

An attacker controlling a ghost zone and able to query a vulnerable Unbound instance can extend the caching duration of certain DNS referral NS records, potentially affecting DNS resolution behavior for up to one additional TTL period. This could influence DNS cache poisoning or related DNS manipulation scenarios. The vulnerability does not require privileges or user interaction but does require control over a ghost zone and query access. No known exploits in the wild have been reported.

Upgrade Unbound to version 1.25.1 or later, which contains a patch preventing TTL extension for parent NS records. Since the vendor advisory indicates the fix is included in 1.25.1, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.