CVE-2022-30698

NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.

• CWE-613

• https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D35CX4SCZVNKZTWJXPDFTHWZHINMGEZD/
• https://security.gentoo.org/glsa/202212-02Third Party Advisory
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D35CX4SCZVNKZTWJXPDFTHWZHINMGEZD/
• https://security.gentoo.org/glsa/202212-02Third Party Advisory
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txtVendor Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30692Improper conditions check in the Intel(R) SUR software befor…7.5
• CVE-2022-30693Information disclosure vulnerability in the system configura…5.3
• CVE-2022-30694The login endpoint /FormLogin in affected web services does …6.5
• CVE-2022-30695Local privilege escalation due to excessive permissions assi…7.8
• CVE-2022-30696Local privilege escalation due to a DLL hijacking vulnerabil…7.8
• CVE-2022-30697Local privilege escalation due to insecure folder permission…7.8
• CVE-2022-30699NLnet Labs Unbound, up to and including version 1.16.1, is v…6.5
• CVE-2022-3070The Generate PDF WordPress plugin before 3.6 does not saniti…4.8
• CVE-2022-30700An incorrect permission assignment vulnerability in Trend Mi…7.8
• CVE-2022-30701An uncontrolled search path element vulnerability in Trend M…7.8
• CVE-2022-30702Trend Micro Security 2022 and 2021 (Consumer) is vulnerable …5.5
• CVE-2022-30703Trend Micro Security 2021 and 2022 (Consumer) is vulnerable …7.8