CVE-2026-40622: NLnet Labs Unbound DNS DoS Vulnerability

CVE-2026-40622 Overview

CVE-2026-40622 affects NLnet Labs Unbound, a widely deployed validating, recursive, and caching DNS resolver. The vulnerability belongs to the ghost domain names family of attacks and impacts versions 1.16.2 through 1.25.0. An attacker controlling a malicious zone can extend the lifetime of cached delegation data beyond its intended expiry. A single client NS query causes Unbound to overwrite the cached, expired parent-side referral NS rrset with the child-side apex NS rrset, prolonging the ghost domain window by up to one cache-max-ttl cycle. The flaw is classified as [CWE-346] Origin Validation Error.

Critical Impact
Attackers who control a revoked or malicious domain can keep it resolvable through Unbound caches long after the parent zone has removed the delegation, undermining domain takedown and revocation efforts.

Affected Products

NLnet Labs Unbound 1.16.2 through 1.25.0
Unbound deployments using default configurations (client-driven NS queries)
Unbound deployments using harden-referral-path: yes (implicit NS queries, no client request required)

Discovery Timeline

2026-05-20 - CVE-2026-40622 published to the National Vulnerability Database
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-40622

Vulnerability Analysis

The vulnerability allows an adversary controlling a ghost zone to keep stale delegation records alive in an Unbound resolver. When a parent zone removes or changes a delegation, the parent-side NS rrset should expire naturally based on its original TTL. In affected Unbound versions, a client-issued NS query for the ghost domain causes the resolver to refresh the cached NS rrset using the child-side apex NS records returned by the attacker-controlled authoritative server. Because Unbound treats the refreshed rrset as authoritative for caching purposes, the entry receives a new TTL bounded by the configured cache-max-ttl.

This behavior contradicts the expectation that revoked or expired delegations stop resolving once registrars or parent zones remove them. The Common Weakness Enumeration classifies this as [CWE-346], an origin validation error in how trust levels for parent and child NS records are reconciled in the cache.

Root Cause

Unbound does not enforce TTL boundaries when child-side apex NS records overwrite the parent-side referral NS rrset. The resolver allows the child-side response, served by the attacker, to extend the cached delegation lifetime. The trust hierarchy between parent-side and child-side NS records is not respected for the purpose of TTL extension.

Attack Vector

The attacker must control a ghost zone, meaning a domain whose delegation has been revoked at the parent but is still resolvable through cached entries. The attacker then issues, or induces a client to issue, an NS query for the ghost domain against a vulnerable Unbound resolver. The resolver refreshes the cached NS rrset using the attacker's authoritative response, restarting the TTL clock. In configurations with harden-referral-path: yes, Unbound issues the NS query implicitly, so no client interaction is required. Repeating the technique each TTL cycle keeps the ghost domain resolvable indefinitely.

No proof-of-concept code is published in the enriched data. See the NLnet Labs CVE-2026-40622 Advisory for the authoritative technical description.

Detection Methods for CVE-2026-40622

Indicators of Compromise

Repeated client NS queries for domains whose delegations have been revoked at the parent zone.
Cached NS rrsets in Unbound that persist beyond the original parent-side TTL.
Outbound resolver traffic to authoritative servers for domains flagged as malicious or recently de-registered.

Detection Strategies

Audit Unbound cache contents using unbound-control dump_cache and compare cached NS TTLs against parent zone authoritative TTLs.
Correlate DNS query logs for NS record types against threat intelligence feeds covering revoked or sinkholed domains.
Monitor for divergence between parent-side and child-side NS rrsets for the same zone across resolver telemetry.

Monitoring Recommendations

Enable Unbound query logging (log-queries: yes) and forward DNS telemetry to a centralized analytics platform for retention and search.
Track resolution of high-risk top-level domains and recently expired registrations for anomalous longevity.
Alert on configurations where harden-referral-path: yes is set, since exploitation does not require client NS queries.

How to Mitigate CVE-2026-40622

Immediate Actions Required

Upgrade Unbound to version 1.25.1 or later, which contains the official fix.
Inventory all recursive resolvers running Unbound 1.16.2 through 1.25.0 and prioritize internet-facing or shared resolvers.
Flush the Unbound cache after upgrading to evict any ghost domain entries that may have been planted prior to patching.

Patch Information

NLnet Labs released Unbound 1.25.1 with a fix that prevents TTL extension for parent NS records regardless of the trust level assigned to the child-side response. The patch enforces correct trust handling between parent-side referral NS rrsets and child-side apex NS rrsets. Refer to the NLnet Labs CVE-2026-40622 Advisory for upgrade instructions and release notes.

Workarounds

Lower the cache-max-ttl setting to reduce the maximum window an attacker can extend per refresh cycle.
Disable harden-referral-path if it is enabled and not strictly required, since this configuration removes the need for client-triggered NS queries.
Use Response Policy Zones (RPZ) or DNS firewall rules to override resolution for known-malicious or revoked domains until patching is complete.

bash

# Configuration example: reduce ghost domain window in unbound.conf
server:
    cache-max-ttl: 3600
    harden-referral-path: no
    # Verify running version after upgrade
    # unbound -V