CVE-2026-40622 — Another 'ghost domain names' attack variant

Description

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

Affected products

Vendor	Product	Affected	Fixed
NLnet Labs	Unbound	1.16.2 – < 1.25.1	1.25.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	unbound	1.25.2-1	—
Debian 13	unbound	1.26.1-0+deb13u1	—
Debian 12	unbound	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	unbound	1.24.2-1ubuntu2.1	—
Ubuntu 25.10	unbound	1.22.0-2ubuntu2.3	—
Ubuntu 24.04 LTS	unbound	1.19.2-1ubuntu3.8	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	unbound	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	unbound +6	1.24.2-7.el10_2.2	RHSA-2026:36320
RHEL 9	unbound +4	1.24.2-3.el9_8.2	RHSA-2026:36777
RHEL 8	unbound +3	1.16.2-5.12.el8_10	RHSA-2026:37282

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Hardened Images 1	unbound +7	1.25.1-1.hum1	RHSA-2026:20357

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	unbound +6	1.24.2-7.el10_2.2	ALSA-2026:36320
AlmaLinux 9	unbound +4	1.24.2-3.el9_8.2	ALSA-2026:36777
AlmaLinux 8	unbound +3	1.16.2-5.12.el8_10	ALSA-2026:37282

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	unbound	1.24.2-7.el10_2.2	RLSA-2026:36320
Rocky Linux 9	unbound	1.24.2-3.el9_8.2	RLSA-2026:36777
Rocky Linux 8	unbound	1.16.2-5.12.el8_10	RLSA-2026:37282

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	unbound	1.25.2-150600.23.19.1	SUSE-SU-2026:3885-1
SLES 15 SP6	unbound	1.25.2-150600.23.19.1	SUSE-SU-2026:3885-1
SLES 15 SP5	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1
SLES 15 SP4	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1

Show 11 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	unbound	1.24.1-160000.2.1	SUSE-SU-2026:23226-1, SUSE-SU-2026:23215-1, SUSE-SU-2026:22160-1
SLES for SAP 15 SP6	unbound	1.25.2-150600.23.19.1	SUSE-SU-2026:3885-1
SLES for SAP 15 SP5	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1
SLES for SAP 15 SP4	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1
SLES 16.0	unbound	1.24.1-160000.2.1	SUSE-SU-2026:23226-1, SUSE-SU-2026:23215-1, SUSE-SU-2026:22160-1
SLE Micro 6.2	unbound	1.24.1-160000.2.1	SUSE-SU-2026:23050-1, SUSE-SU-2026:22213-1
SLE Micro 6.1	unbound	1.25.2-slfo.1.1_1.1	SUSE-SU-2026:23349-1
SLE Micro 6.0	unbound	1.25.2-1.1	SUSE-SU-2026:23360-1
SLE Micro 5.5	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1
SLE HPC 15 SP5	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1
SLE HPC 15 SP4	unbound	1.20.0-150100.10.25.1	SUSE-SU-2026:2369-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	unbound	1.25.1-1.1	openSUSE-SU-2026:10903-1
openSUSE Leap 16.0	unbound	1.24.1-160000.2.1	openSUSE-SU-2026:21550-1, openSUSE-SU-2026:21083-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	unbound	1.25.1-r0	—
Alpine v3.23	unbound	1.25.2-r0	—
Alpine v3.22	unbound	1.25.2-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	unbound +5	1.17.1-1.amzn2023.0.12	ALAS2023-2026-1756

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	unbound	1.25.1-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	unbound +6	1.24.2-7.el10_2.2	ELSA-2026-36320
Oracle Linux 9	unbound +4	1.24.2-3.el9_8.2	ELSA-2026-36777
Oracle Linux 8	unbound +3	1.16.2-5.12.el8_10	ELSA-2026-37282

Advisories 29

WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-1599 Unbound: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2026:36777 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:36320 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:37282 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:37282 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
RHSA-2026:36777 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
RHSA-2026:36320 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
RHSA-2026:20357 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
SUSE-SU-2026:3885-1 Security update for unbound SUSE / openSUSE Security Updates · Sep 10, 2026
SUSE-SU-2026:23349-1 Security update for unbound SUSE / openSUSE Security Updates · Sep 10, 2026
SUSE-SU-2026:23360-1 Security update for unbound SUSE / openSUSE Security Updates · Sep 10, 2026
SUSE-SU-2026:23226-1 Security update for unbound SUSE / openSUSE Security Updates · Aug 27, 2026
SUSE-SU-2026:23215-1 Security update for unbound SUSE / openSUSE Security Updates · Aug 27, 2026
WID-SEC-2026-3038 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026
openSUSE-SU-2026:21550-1 Security update for unbound SUSE / openSUSE Security Updates · Aug 12, 2026
SUSE-SU-2026:23050-1 Security update for unbound SUSE / openSUSE Security Updates · Aug 12, 2026
RLSA-2026:36777 Important: unbound security update Rocky Linux Security Advisories · Jul 28, 2026
RLSA-2026:36320 Important: unbound security update Rocky Linux Security Advisories · Jul 28, 2026
RLSA-2026:37282 Important: unbound security update Rocky Linux Security Advisories · Jul 28, 2026
ELSA-2026-36320 Important: unbound security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
ELSA-2026-36777 Important: unbound security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 9, 2026
ELSA-2026-37282 Important: unbound security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 9, 2026
openSUSE-SU-2026:21083-1 Security update for unbound SUSE / openSUSE Security Updates · Jun 30, 2026
SUSE-SU-2026:22160-1 Security update for unbound SUSE / openSUSE Security Updates · Jun 24, 2026
SUSE-SU-2026:22213-1 Security update for unbound SUSE / openSUSE Security Updates · Jun 24, 2026
SUSE-SU-2026:2369-1 Security update for unbound SUSE / openSUSE Security Updates · Jun 12, 2026
openSUSE-SU-2026:10903-1 libunbound8-1.25.1-1.1 on GA media SUSE / openSUSE Security Updates · May 30, 2026
ALAS2023-2026-1756 Important: unbound security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt vendor-advisory

CNA	v4.0	6.6
EUVD	v4.0	6.6