CVE-2022-30698

CVE-2022-30698: vulnerability in NLnet Labs Unbound

Novel "ghost domain names" attack by introducing subdomain delegations

Published · Updated

Follow this CVE+ Monitor Unbound+ Monitor unbound

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.2%
NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.
Affected products
NLnet Labs · Unbound
Related CVEs — NLnet Labs Unbound

In the same product, most dangerous first.

CVE-2024-1931HIGHDenial of service when trimming EDE text on positive repliesEPSS 2.5%CVE-2022-3204HIGHNRDelegation AttackEPSS 1.6%CVE-2026-33278CRITICALPossible arbitrary code execution during DNSSEC validationEPSS 1.4%CVE-2022-30699—Novel "ghost domain names" attack by updating almost expired delegation informationEPSS 1.2%CVE-2026-81642CRITICALHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYEPSS 1.0%CVE-2026-42944HIGHHeap overflow with multiple NSID, COOKIE, PADDING EDNS optionsEPSS 0.8%