CVE-2026-42955: NLnet Labs Unbound DoS Vulnerability

CVE-2026-42955 Overview

CVE-2026-42955 affects NLnet Labs Unbound recursive DNS resolver versions 1.16.2 through 1.25.1. The vulnerability belongs to the 'ghost domain names' family of attacks and is a variant of CVE-2026-40622. An adversary controlling a ghost zone can query a vulnerable Unbound resolver and cause it to overwrite the cached expired parent-side glue RRset for A/AAAA records. This extends the ghost domain window by up to one cached TTL value defined by cache-max-ttl. The flaw is tracked under CWE-672: Operation on a Resource After Expiration or Release.

Critical Impact
A single client A/AAAA query can prolong the lifetime of a revoked domain in Unbound's cache, allowing attacker-controlled ghost domains to remain resolvable beyond registry expiration.

Affected Products

NLnet Labs Unbound 1.16.2 through 1.25.1
Deployments using default configurations (client-driven exploitation)
Deployments using harden-referral-path: yes (implicit exploitation, no client query required)

Discovery Timeline

2026-07-22 - CVE-2026-42955 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-42955

Vulnerability Analysis

Ghost domain name attacks abuse recursive resolvers to keep resolving domain names that have been removed from the parent zone. CVE-2026-40622 addressed this class of issue for NS queries. CVE-2026-42955 extends the same problem to A and AAAA glue records, which the earlier patch did not cover.

When Unbound receives a client A or AAAA query for a name inside an attacker-controlled zone, it consults the parent-side glue RRset. If that glue has expired, Unbound refreshes it and writes the new record into cache with a fresh TTL up to the configured cache-max-ttl. The attacker returns updated glue in the referral, effectively resetting the expiration clock on the ghost delegation. Repeating this cycle keeps the ghost domain resolvable indefinitely despite parent-zone removal.

Root Cause

The root cause is improper handling of expired parent-side glue A/AAAA RRsets during referral processing. Unbound overwrites the expired cached glue with attacker-supplied values instead of validating whether the delegation itself remains authoritative at the parent. The fix for CVE-2026-40622 restricted this behavior only for NS RRsets, leaving glue records exploitable.

Attack Vector

The attacker must control a zone previously delegated by a parent zone and must be able to send or trigger queries against a vulnerable Unbound resolver. In default configurations, an adversary elicits an A/AAAA query for a name within the ghost zone. In deployments with harden-referral-path: yes set, Unbound implicitly issues the required query itself, removing the need for external triggering. The attack requires high complexity but no privileges or user interaction, and the impact is limited to integrity of the DNS cache.

No verified proof-of-concept code is available. See the NLnet Labs advisory for CVE-2026-42955 for authoritative technical details.

Detection Methods for CVE-2026-42955

Indicators of Compromise

Cached A/AAAA glue records for delegations whose parent-zone NS/glue no longer exists at the registry or TLD servers
Repeated referrals from the same authoritative server refreshing glue for a domain that has been removed upstream
Unbound cache entries persisting for domains that WHOIS or registry data indicate as expired or suspended

Detection Strategies

Compare Unbound cache contents with authoritative parent-zone data and flag deltas where glue is present locally but absent at the parent
Correlate DNS resolver telemetry with threat intelligence feeds identifying known ghost or takedown domains
Inspect Unbound query logs for high-frequency A/AAAA queries that repeatedly refresh the same delegation glue near TTL expiry

Monitoring Recommendations

Enable Unbound query logging and forward records into a centralized analytics platform for retention and correlation
Track resolver responses for domains flagged by registrars or CERTs as revoked, sinkholed, or seized
Alert on outbound resolutions to newly observed IP addresses tied to previously suspended domains

How to Mitigate CVE-2026-42955

Immediate Actions Required

Upgrade Unbound to a version later than 1.25.1 that includes the fix, as published by NLnet Labs
Inventory all Unbound resolvers in the environment, including those bundled with appliances and container images
Review unbound.conf for harden-referral-path: yes, which broadens the exposure surface

Patch Information

Apply the vendor patch documented in the NLnet Labs CVE-2026-42955 advisory. The patch extends the CVE-2026-40622 remediation to A and AAAA glue RRsets so that expired parent-side glue is not overwritten by attacker-supplied referral data.

Workarounds

Lower cache-max-ttl to reduce the maximum extension window an attacker can achieve per refresh cycle
Disable harden-referral-path where operationally acceptable to avoid implicit glue refresh queries
Restrict which clients may query the resolver using access-control directives to limit exposure to untrusted networks

bash

# Configuration example: reduce ghost domain window in unbound.conf
server:
    cache-max-ttl: 3600
    harden-referral-path: no
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse