CVE-2026-42955 (Low) detected in src4.0.4

[mend-bolt-for-github]

CVE-2026-42955 - Low Severity Vulnerability

Vulnerable Library - src4.0.4

Library home page: https://github.com/MidnightBSD/src.git

Found in base branches: stable/4.0, master

Vulnerable Source Files (1)

/contrib/unbound/services/cache/rrset.c

Vulnerability Details

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.

Publish Date: 2026-07-22

URL: CVE-2026-42955

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-22

Fix Resolution: https://github.com/NLnetLabs/unbound.git - release-1.25.2

---

Step up your Open Source Security Game with Mend here