CVE-2026-42955

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42955", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-22T10:11:10.510Z", "datePublished": "2026-07-22T13:05:53.695Z", "dateUpdated": "2026-07-22T14:26:48.806Z"}, "containers": {"cna": {"title": "Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records", "datePublic": "2026-07-22T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.16.2", "status": "affected", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-672", "description": "CWE-672: Operation on a Resource after Expiration or Release", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "timeline": [{"time": "2026-05-22T00:00:00.000Z", "lang": "en", "value": "Issue reported by Qifan Zhang"}, {"time": "2026-06-10T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch"}, {"time": "2026-06-13T00:00:00.000Z", "lang": "en", "value": "Qifan Zhang verifies patch"}, {"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.25.2"}], "credits": [{"lang": "en", "value": "Qifan Zhang (Palo Alto Networks)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:05:53.695Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:26:22.407643Z", "id": "CVE-2026-42955", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:26:48.806Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:26:22.407643Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:26:43.752Z"}}], "cna": {"title": "Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang (Palo Alto Networks)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.16.2", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-22T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-06-10T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-13T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Fixes released with version 1.25.2"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-672", "description": "CWE-672: Operation on a Resource after Expiration or Release"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:05:53.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42955", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:26:48.806Z", "dateReserved": "2026-06-22T10:11:10.510Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-07-22T13:05:53.695Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unbound", "vendor": "NLnet Labs", "versions": [{"lessThan": "1.25.2", "status": "affected", "version": "1.16.2", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7729D72-F659-41EF-BEE3-4FFCF0785654", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.16.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.16.2 hasta la versi\u00f3n 1.25.1 inclusive, se encontr\u00f3 en Unbound una vulnerabilidad similar a la de CVE-2026-40622 en la familia de ataques de \u2019nombres de dominio fantasma\u2019 que podr\u00eda extender la ventana del dominio fantasma hasta en un valor configurado de TTL en cach\u00e9 para registros glue A/AAAA. Similar a otros ataques de \u2019nombres de dominio fantasma\u2019, un adversario necesita controlar una zona (fantasma) y ser capaz de consultar un Unbound vulnerable. Una \u00fanica consulta A/AAAA de cliente puede hacer que Unbound sobrescriba el rrset glue caducado del lado del padre en cach\u00e9 y esencialmente extienda la ventana del dominio fantasma hasta en un valor configurado de TTL en cach\u00e9 (\u2019cache-max-ttl\u2019). En configuraciones donde se utiliza \u2019harden-referral-path: yes\u2019 (configuraci\u00f3n no predeterminada), no se requiere ninguna consulta de cliente ya que Unbound realiza esa consulta impl\u00edcitamente. Esta es una variante de CVE-2026-40622 que solo abordaba la consulta NS."}], "id": "CVE-2026-42955", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42955", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T14:26:22.407643Z", "version": "2.0.3"}}]}, "published": "2026-07-22T14:17:18.680", "references": [{"source": "sep@nlnetlabs.nl", "tags": ["Vendor Advisory"], "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-672"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "unbound: Unbound: DNS cache integrity issue", "id": "2506144", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506144"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-354", "details": ["A \"ghost domain names\" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure harden-referral-path is set to no (the default) to prevent Unbound from implicitly triggering the vulnerable cache overwrites.\nAdditionally, restrict recursive DNS access strictly to trusted clients to prevent external attackers from manually triggering the flaw.\nRestart the Unbound service to apply these configuration changes."}, "name": "CVE-2026-42955", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "unbound", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-22T13:05:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42955\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42955\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt"], "statement": "This Low impact DNS cache integrity issue in Unbound allows an attacker to extend the window for serving outdated DNS information. Exploitation requires an adversary to control a ghost zone and query a vulnerable Unbound instance. The risk is elevated if the non-default `harden-referral-path: yes` configuration is enabled, as it removes the need for a client query.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.16.2,1.25.2)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Unbound", "source": "cna", "vendor": "NLnet Labs"}, "product": "unbound", "vendor": "nlnetlabs"}], "created": "2026-07-26T05:15:12.038291+00:00", "updated": "2026-08-02T18:15:04.372432+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$unbound"]}