CVE-2026-42955

Microsoft · Published July 23, 2026

3.7

CVSS v3.1

INFO

Patch availableGet patch

Description

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records. Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

Affected Products

azl3 unbound 1.25.1-1 on Azure Linux 3.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U