This vulnerability in Unbound DNS resolver software affects versions 1.16.2 up to and including 1.25.1. It allows an attacker who controls a ghost zone and can query a vulnerable Unbound instance to extend the ghost domain window by overwriting the cached expired parent-side glue rrset for A/AAAA records. The extension can be up to one cached TTL configured value ('cache-max-ttl'). When the non-default configuration 'harden-referral-path: yes' is enabled, Unbound performs the query implicitly, removing the need for a client query. This issue is a variant of CVE-2026-40622, which addressed a similar problem with NS queries.

The vulnerability allows an attacker controlling a ghost zone to extend the ghost domain window by up to one cached TTL for A/AAAA glue records, potentially causing Unbound to use stale DNS data longer than intended. This could lead to incorrect DNS resolution behavior. The CVSS score is 3.7 (low), indicating limited impact with no confidentiality or availability effects and only low integrity impact.

No official patch or remediation level has been published by NLnet Labs at this time. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, consider avoiding the use of the 'harden-referral-path: yes' configuration if feasible, as it can implicitly trigger the vulnerable query. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.