The CVE number for this vulnerability is CVE-2026-42955.


== Summary
A similar vulnerability as with CVE-2026-40622 in the "ghost domain names"
family of attacks was found in Unbound that could extend the ghost domain
window by up to one cached TTL configured value for A/AAAA glue records.

Unbound 1.25.2 includes a fix that does not allow extension of TTLs for
(parent) A/AAAA records regardless of their trust.


== Affected products
Unbound 1.16.2 up to and including version 1.25.1.


== Description
Similar to other "ghost domain names" attacks, an adversary needs to control
a (ghost) zone and be able to query a vulnerable Unbound.
A single client A/AAAA query can cause Unbound to overwrite the cached expired
parent-side glue rrset and essentially extend the ghost domain window by up to
one cached TTL configured value ('cache-max-ttl').
In configurations where 'harden-referral-path: yes' is used (non-default
configuration), no client query is required since Unbound implicitly performs
that query.
This is a variant of CVE-2026-40622 which only addressed the NS query.


Unbound 1.25.2 includes a fix that does not allow extension of TTLs for
(parent) A/AAAA records regardless of their trust.


== Mitigation

=== Downloading patched version
Unbound 1.25.2 is released with the patch
https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz

=== Applying the patch manually
For Unbound 1.25.1 the patch is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-42955_with.diff

Apply the patch on the Unbound source directory with:
    patch -p1 < patch_CVE-2026-42955_with.diff
then run 'make install' to install Unbound.

A minimal patch that only addresses the vulnerability without further code
improvements is:
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-42955.diff
and can be used INSTEAD to make it easier for patching.

Both patches are tested to work on Unbound 1.25.1.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.