CVE-2026-40622
Description
A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain (a "ghost zone") and querying a vulnerable Unbound server, could exploit a vulnerability related to "ghost domain names" attacks. This could allow the attacker to overwrite cached Name Server (NS) records, extending the "ghost domain window" by up to one cached Time To Live (TTL) value. This manipulation could lead to cache poisoning, potentially causing the Unbound server to serve incorrect or malicious DNS information.
Statement
This Moderate flaw in Unbound allows a remote attacker to manipulate the DNS cache via a "ghost domain names" attack. An attacker controlling a malicious zone can extend the validity of cached Name Server records, potentially leading to cache poisoning and the provision of incorrect DNS information. The vulnerability is more readily exploitable in non-default configurations where harden-referral-path: yes is enabled, as this setting removes the requirement for a client NS query.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
