The vulnerability is part of the 'ghost domain names' family and enables an attacker who controls a zone and can query a vulnerable Unbound instance to overwrite an expired parent‑side referral NS record with the child‑side apex NS record. This overwrite extends the period during which the attacker‑controlled NS records remain valid by up to the configured cache‑max‑ttl value. The result is an extended window in which DNS resolvers will return rogue NS records, potentially leading to DNS spoofing or denial of service once the unwanted records are no longer intended to be authoritative.

NLnet Labs Unbound versions from 1.16.2 through 1.25.0 are affected. Any deployment using a version in that range will be vulnerable, while Unbound 1.25.1 and later contain the fix that prevents TTL extension of parent NS records.

The CVSS score of 6.6 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests a very low public exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to own a zone and issue a query, unless the deployer is using the non‑default 'harden‑referral‑path: yes' configuration; in that case the server performs the query automatically, removing the need for an external trigger. Based on the description, it is inferred that environments with exposed zones and vulnerable Unbound installations are the most at risk.