{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42955", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-22T10:11:10.510Z", "datePublished": "2026-07-22T13:05:53.695Z", "dateUpdated": "2026-07-22T14:26:48.806Z"}, "containers": {"cna": {"title": "Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records", "datePublic": "2026-07-22T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"version": "1.16.2", "status": "affected", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-672", "description": "CWE-672: Operation on a Resource after Expiration or Release", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "timeline": [{"time": "2026-05-22T00:00:00.000Z", "lang": "en", "value": "Issue reported by Qifan Zhang"}, {"time": "2026-06-10T00:00:00.000Z", "lang": "en", "value": "NLnet Labs shares patch"}, {"time": "2026-06-13T00:00:00.000Z", "lang": "en", "value": "Qifan Zhang verifies patch"}, {"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Fixes released with version 1.25.2"}], "credits": [{"lang": "en", "value": "Qifan Zhang (Palo Alto Networks)", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:05:53.695Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:26:22.407643Z", "id": "CVE-2026-42955", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:26:48.806Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:26:22.407643Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:26:43.752Z"}}], "cna": {"title": "Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang (Palo Alto Networks)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.16.2", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-22T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-06-10T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-13T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Fixes released with version 1.25.2"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 1.25.2"}], "datePublic": "2026-07-22T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-672", "description": "CWE-672: Operation on a Resource after Expiration or Release"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-07-22T13:05:53.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42955", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:26:48.806Z", "dateReserved": "2026-06-22T10:11:10.510Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-07-22T13:05:53.695Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "unbound: Unbound: DNS cache integrity issue", "id": "2506144", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506144"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-354", "details": ["A \"ghost domain names\" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure harden-referral-path is set to no (the default) to prevent Unbound from implicitly triggering the vulnerable cache overwrites.\nAdditionally, restrict recursive DNS access strictly to trusted clients to prevent external attackers from manually triggering the flaw.\nRestart the Unbound service to apply these configuration changes."}, "name": "CVE-2026-42955", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "unbound", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-22T13:05:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42955\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42955\nhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt"], "statement": "This Low impact DNS cache integrity issue in Unbound allows an attacker to extend the window for serving outdated DNS information. Exploitation requires an adversary to control a ghost zone and query a vulnerable Unbound instance. The risk is elevated if the non-default `harden-referral-path: yes` configuration is enabled, as it removes the need for a client query.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.16.2,1.25.2)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Unbound", "source": "cna", "vendor": "NLnet Labs"}, "product": "unbound", "vendor": "nlnetlabs"}], "created": "2026-07-26T05:15:12.038291+00:00", "updated": "2026-07-30T09:30:15.248742+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$unbound"]}