CVE-2026-42955

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.16.2 through 1.25.1

Description An issue exists within the ghost domain names family of attacks where an adversary controlling a ghost zone can extend the ghost domain window for A/AAAA glue records. By sending a single client A/AAAA query, the attacker can cause the system to overwrite the cached expired parent-side glue rrset, extending the window by up to one cached TTL configured value, specifically the cache-max-ttl variable. In configurations where harden-referral-path: yes is enabled, the issue can be triggered without a client query as the system performs the query implicitly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.