CVE-2026-40622 (GCVE-0-2026-40622)

Vulnerability from cvelistv5 – Published: 2026-05-20 09:18 – Updated: 2026-05-20 12:12
VLAI
Title
Another 'ghost domain names' attack variant
Summary
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.
Severity
6.6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:12 UTC
CWE
  • CWE-346 - Origin Validation Error
Assigner
References
Impacted products
Vendor Product Version CPE status
NLnet Labs Unbound Affected: 1.16.2 , < 1.25.1 (semver)
guessed Create a notification for this product.
Date Public
2026-05-20 00:00
Credits
Qifan Zhang (Palo Alto Networks)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40622",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T12:12:27.631955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T12:12:33.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unbound",
          "vendor": "NLnet Labs",
          "versions": [
            {
              "lessThan": "1.25.1",
              "status": "affected",
              "version": "1.16.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qifan Zhang (Palo Alto Networks)"
        }
      ],
      "datePublic": "2026-05-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0027ghost domain names\u0027 family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0027ghost domain names\u0027 attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0027cache-max-ttl\u0027). In configurations where \u0027harden-referral-path: yes\u0027 is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T09:18:41.816Z",
        "orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
        "shortName": "NLnet Labs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed starting with version 1.25.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-28T00:00:00.000Z",
          "value": "Issue reported by Qifan Zhang"
        },
        {
          "lang": "en",
          "time": "2026-05-07T00:00:00.000Z",
          "value": "NLnet Labs shares patch"
        },
        {
          "lang": "en",
          "time": "2026-05-08T00:00:00.000Z",
          "value": "Qifan Zhang verifies patch"
        },
        {
          "lang": "en",
          "time": "2026-05-20T00:00:00.000Z",
          "value": "Fixes released with version 1.25.1"
        }
      ],
      "title": "Another \u0027ghost domain names\u0027 attack variant",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
    "assignerShortName": "NLnet Labs",
    "cveId": "CVE-2026-40622",
    "datePublished": "2026-05-20T09:18:41.816Z",
    "dateReserved": "2026-05-07T10:07:51.817Z",
    "dateUpdated": "2026-05-20T12:12:33.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40622",
      "date": "2026-09-22",
      "epss": "0.00136",
      "percentile": "0.03375"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-23T01:40:18.000Z",
      "cve": "CVE-2026-40622",
      "id": "msrc_CVE-2026-40622",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Another \u0027ghost domain names\u0027 attack variant",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-40622.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Unbound",
                "vendor": "NLnet Labs",
                "versions": [
                  {
                    "lessThan": "1.25.1",
                    "status": "affected",
                    "version": "1.16.2",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "sep@nlnetlabs.nl"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5D0F980-AB26-4DA7-9868-C45A31600BB0",
                    "versionEndExcluding": "1.25.1",
                    "versionStartIncluding": "1.16.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0027ghost domain names\u0027 family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0027ghost domain names\u0027 attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0027cache-max-ttl\u0027). In configurations where \u0027harden-referral-path: yes\u0027 is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust."
          },
          {
            "lang": "es",
            "value": "NLnet Labs Unbound 1.16.2 hasta la versi\u00f3n 1.25.0 inclusive tiene una vulnerabilidad de la familia de ataques de \u0027nombres de dominio fantasma\u0027 que podr\u00eda extender la ventana de dominio fantasma hasta un valor configurado de TTL en cach\u00e9. Similar a otros ataques de \u0027nombres de dominio fantasma\u0027, un adversario necesita controlar una zona (fantasma) y ser capaz de consultar un Unbound vulnerable. Una \u00fanica consulta NS de cliente puede hacer que Unbound sobrescriba el conjunto de registros NS de referencia del lado del padre caducado en cach\u00e9 con el conjunto de registros NS de \u00e1pice del lado del hijo y esencialmente extender la ventana de dominio fantasma hasta un valor configurado de TTL en cach\u00e9 (\u0027cache-max-ttl\u0027). En configuraciones donde se usa \u0027harden-referral-path: yes\u0027 (configuraci\u00f3n no predeterminada), no se requiere ninguna consulta NS de cliente ya que Unbound realiza impl\u00edcitamente esa consulta. Unbound 1.25.1 contiene un parche con una correcci\u00f3n que no permite la extensi\u00f3n de los TTL para registros NS (padre) independientemente de su confianza."
          }
        ],
        "id": "CVE-2026-40622",
        "lastModified": "2026-07-24T10:10:00.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "UNREPORTED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "AMBER",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "sep@nlnetlabs.nl",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-40622",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T12:12:27.631955Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-20T10:16:26.850",
        "references": [
          {
            "source": "sep@nlnetlabs.nl",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt"
          }
        ],
        "sourceIdentifier": "sep@nlnetlabs.nl",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T08:40:12+00:00",
      "cve": "CVE-2026-40622",
      "id": "CVE-2026-40622",
      "initial_release_date": "2026-05-20T09:18:41.816000+00:00",
      "product_status:fixed": "187",
      "product_status:known_affected": "11",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "unbound: Unbound: Cache manipulation via \u0027ghost domain names\u0027 attack",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40622.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T23:36:22Z",
      "cve": "CVE-2026-40622",
      "id": "CVE-2026-40622",
      "initial_release_date": "2026-05-30T02:07:30Z",
      "product_status:known_affected": "56",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-40622",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-40622.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-40622",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-20T12:12:27.631955Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-346",
                    "description": "CWE-346 Origin Validation Error",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-20T12:12:21.123Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Unbound",
              "vendor": "NLnet Labs",
              "versions": [
                {
                  "lessThan": "1.25.1",
                  "status": "affected",
                  "version": "1.16.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Qifan Zhang (Palo Alto Networks)"
            }
          ],
          "datePublic": "2026-05-20T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0027ghost domain names\u0027 family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0027ghost domain names\u0027 attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0027cache-max-ttl\u0027). In configurations where \u0027harden-referral-path: yes\u0027 is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber",
                "version": "4.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-20T09:18:41.816Z",
            "orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
            "shortName": "NLnet Labs"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "This issue is fixed starting with version 1.25.1"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-04-28T00:00:00.000Z",
              "value": "Issue reported by Qifan Zhang"
            },
            {
              "lang": "en",
              "time": "2026-05-07T00:00:00.000Z",
              "value": "NLnet Labs shares patch"
            },
            {
              "lang": "en",
              "time": "2026-05-08T00:00:00.000Z",
              "value": "Qifan Zhang verifies patch"
            },
            {
              "lang": "en",
              "time": "2026-05-20T00:00:00.000Z",
              "value": "Fixes released with version 1.25.1"
            }
          ],
          "title": "Another \u0027ghost domain names\u0027 attack variant",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
        "assignerShortName": "NLnet Labs",
        "cveId": "CVE-2026-40622",
        "datePublished": "2026-05-20T09:18:41.816Z",
        "dateReserved": "2026-05-07T10:07:51.817Z",
        "dateUpdated": "2026-05-20T12:12:33.115Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.