CVE-2026-42955 Other in Unbound

Low 3.7 Published 22 Jul 2026 Updated 22 Jul 2026

Attackers can extend the validity of expired DNS glue records, bypassing cache expiration mechanisms in Unbound DNS resolver.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-42955?

CVE-2026-42955 is a low-severity vulnerability in Nlnetlabs Unbound, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.

Weakness: CWE-672

Which versions are affected by CVE-2026-42955?

It affects 1 product.

Products include Nlnetlabs Unbound.

How do I fix CVE-2026-42955?

Apply the vendor's patch.

Is CVE-2026-42955 being exploited?

There is no known exploitation of CVE-2026-42955 in the wild and no public exploit code.

All Nlnetlabs Unbound vulnerabilities

Sources

Also known as ALPINE-CVE-2026-42955, AZL-92964, DEBIAN-CVE-2026-42955, ECHO-5b87-58c9-5e30, GHSA-2pwm-327c-rq4r, UBUNTU-CVE-2026-42955.