Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability was found that allows an attacker to keep a 'ghost' domain active in the resolver's cache even after the domain should have expired or been removed by the parent registry. This could allow malicious domains to remain reachable longer than intended, potentially bypassing certain security controls or administrative removals.
Technical details
This vulnerability is a variant of the 'ghost domain names' attack class, specifically affecting A/AAAA glue records. In Unbound versions 1.16.2 through 1.25.1, a single client query for A/AAAA records can cause the resolver to overwrite an expired parent-side glue RRset with a new TTL, extending the domain's lifespan in the cache by up to the 'cache-max-ttl' value. While typically requiring a client query, configurations with 'harden-referral-path: yes' are vulnerable to implicit triggers. An attacker must control the target zone and have network access to query the resolver. The issue is resolved in Unbound version 1.25.2 by preventing TTL extensions for parent A/AAAA records regardless of trust levels.
Affected products
- NLnet Labs Unbound 1.16.2 through 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2