CVE-2026-40622

A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain (a "ghost zone") and querying a vulnerable Unbound server, could exploit a vulnerability related to "ghost domain names" attacks. This could allow the attacker to overwrite cached Name Server (NS) records, extending the "ghost domain window" by up to one cached Time To Live (TTL) value. This manipulation could lead to cache poisoning, potentially causing the Unbound server to serve incorrect or malicious DNS information.

This Moderate flaw in Unbound allows a remote attacker to manipulate the DNS cache via a "ghost domain names" attack. An attacker controlling a malicious zone can extend the validity of cached Name Server records, potentially leading to cache poisoning and the provision of incorrect DNS information. The vulnerability is more readily exploitable in non-default configurations where harden-referral-path: yes is enabled, as this setting removes the requirement for a client NS query.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.