7.5

CVE-2026-40622: nlnet labs unbound Origin Validation Error

CVSS: 7.5v3.1HighAnalyzed
AliasesALPINE-CVE-2026-40622UBUNTU-CVE-2026-40622DEBIAN-CVE-2026-40622
Published 20-05-2026Last modified 20-05-2026
Open JSON

Vulnerability summary

CVE-2026-40622 is a high (CVSS 7.5) Origin Validation Error vulnerability in nlnet labs unbound. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 13
MGASA-2026-0451OPENSUSE-SU-2026:10903-1OPENSUSE-SU-2026:21083-1OPENSUSE-SU-2026:21550-1RHSA-2026:20357RHSA-2026:36320

Timeline

  1. 20-05-2026
    PublishedVulnerability first disclosed.
  2. 20-05-2026
    Last modifiedVulnerability information updated.

Description

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

CVSS metrics

7 scores · 5 sources · 2 versions

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Alpine1 product
  • unbound≥ 1.16.2, < 1.25.2-r0 | ≥ 1.16.2, < 1.25.1-r0
Debian1 product
  • unboundAll versions (No fix recorded) | < 1.26.1-0+deb13u1 | < 1.25.2-1
Nlnet labs1 product
Nlnetlabs1 product
Ubuntu1 product
  • unboundAll versions (No fix recorded) | < 1.19.2-1ubuntu3.8 | < 1.22.0-2ubuntu2.3 | < 1.24.2-1ubuntu2.1

5 vendors · 5 products

References

8 links