Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs
CVE-2026-42955Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
Low 3.7
In plain English
A low-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-42955 |
| Alpine:v3.23 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-42955 |
| Alpine:v3.24 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-42955 |
| Debian:12 | unbound | no fix listed | DEBIAN-CVE-2026-42955 |
| Debian:13 | unbound | 1.26.1-0+deb13u1 | DEBIAN-CVE-2026-42955 |
| Debian:14 | unbound | 1.25.2-1 | DEBIAN-CVE-2026-42955 |
| Ubuntu:22.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-42955 |
| Ubuntu:24.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-42955 |
| Ubuntu:26.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-42955 |
| Ubuntu:26.10 | unbound | no fix listed | UBUNTU-CVE-2026-42955 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 1.16.2 – before 1.25.2 |
Weakness: CWE-672 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt vendor-advisory