CVE-2026-42955

{
  "id": "CVE-2026-42955",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T14:17:18.680",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query."
    },
    {
      "lang": "es",
      "value": "En NLnet Labs Unbound 1.16.2 hasta la versión 1.25.1 inclusive, se encontró en Unbound una vulnerabilidad similar a la de CVE-2026-40622 en la familia de ataques de ’nombres de dominio fantasma’ que podría extender la ventana del dominio fantasma hasta en un valor configurado de TTL en caché para registros glue A/AAAA. Similar a otros ataques de ’nombres de dominio fantasma’, un adversario necesita controlar una zona (fantasma) y ser capaz de consultar un Unbound vulnerable. Una única consulta A/AAAA de cliente puede hacer que Unbound sobrescriba el rrset glue caducado del lado del padre en caché y esencialmente extienda la ventana del dominio fantasma hasta en un valor configurado de TTL en caché (’cache-max-ttl’). En configuraciones donde se utiliza ’harden-referral-path: yes’ (configuración no predeterminada), no se requiere ninguna consulta de cliente ya que Unbound realiza esa consulta implícitamente. Esta es una variante de CVE-2026-40622 que solo abordaba la consulta NS."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NLnet Labs",
          "product": "Unbound",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.16.2",
              "lessThan": "1.25.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:26:22.407643Z",
          "id": "CVE-2026-42955",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-672"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.16.2",
              "versionEndExcluding": "1.25.2",
              "matchCriteriaId": "F7729D72-F659-41EF-BEE3-4FFCF0785654"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}