CVE-2026-42955

A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses.

This Low impact DNS cache integrity issue in Unbound allows an attacker to extend the window for serving outdated DNS information. Exploitation requires an adversary to control a ghost zone and query a vulnerable Unbound instance. The risk is elevated if the non-default harden-referral-path: yes configuration is enabled, as it removes the need for a client query.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure harden-referral-path is set to no (the default) to prevent Unbound from implicitly triggering the vulnerable cache overwrites. Additionally, restrict recursive DNS access strictly to trusted clients to prevent external attackers from manually triggering the flaw. Restart the Unbound service to apply these configuration changes.