CVE-2026-42955 NLnet Labs CVE debrief

Who should care

Users of Unbound 1.16.2 through 1.25.1 should verify their configurations and consider updating to a patched version. This includes operators of Unbound installations, platform administrators, vulnerability management teams, and security teams. The vulnerability can have an impact on the security posture of affected systems, and defenders should take steps to mitigate the vulnerability.

Technical summary

CVE-2026-42955 is a 'ghost domain names' vulnerability in Unbound 1.16.2 through 1.25.1. An adversary controlling a ghost zone can query a vulnerable Unbound to extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. In configurations with 'harden-referral-path: yes', no client query is required. This vulnerability is a variant of CVE-2026-40622, which only addressed the NS query. The vulnerability can be mitigated by verifying Unbound versions and configurations, reviewing and adjusting 'harden-referral-path' settings if necessary, and considering updates to a patched Unbound version.

Defensive priority

Low

Recommended defensive actions

• Verify Unbound version and configurations
• Consider updating to a patched Unbound version
• Review and adjust 'harden-referral-path' settings if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information. Further investigation is needed to fully understand the vulnerability and its potential impact. The vulnerability affects Unbound versions 1.16.2 through 1.25.1 and is related to the 'ghost domain names' family of attacks. An adversary controlling a ghost zone can query a vulnerable Unbound to extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. In configurations with 'harden-referral-path: yes', no client query is required. The impact of this vulnerability is still being analyzed, and defenders should verify their configurations and consider updating to a patched version.

Official resources