In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the ghost domain names family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other ghost domain names attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value (cache-max-ttl). In configurations where harden-referral-path: yes is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.
Weakness
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Unbound | Nlnetlabs | 1.16.2 (including) | 1.25.2 (excluding) |
| Red Hat Hardened Images | RedHat | unbound-main-1.25.2-0.1.hum1 | * |
| Unbound | Ubuntu | upstream | * |