In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of… (CVE-2026-42955)

The vulnerability in NLnet Labs Unbound from version 1.16.2 up to and including 1.25.1 is a variant of the 'ghost domain names' attack family, similar to CVE-2026-40622. It allows an adversary who controls a ghost zone and can query a vulnerable Unbound resolver to extend the ghost domain window by up to one cached TTL value for A/AAAA glue records. This is achieved by causing Unbound to overwrite the cached expired parent-side glue rrset. In configurations where 'harden-referral-path' is enabled, Unbound implicitly performs the query, removing the need for a client query to trigger the issue. This vulnerability does not affect confidentiality or availability but can impact cache integrity.

The vulnerability allows an attacker controlling a ghost zone to extend the caching period of expired glue records in Unbound, potentially causing the resolver to use stale DNS data longer than intended. This can lead to cache poisoning scenarios affecting DNS resolution integrity. There is no direct impact on confidentiality or availability. The attack requires control over a ghost zone and the ability to query the vulnerable resolver.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should review their Unbound configurations, especially the use of 'harden-referral-path', and monitor vendor advisories for updates or patches addressing this vulnerability.