CVE-2022-30699

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue nameserver delays the response so that the cached delegation information is expired. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries. This action can be repeated when the delegation information is about to expire making the rogue delegation information ever-updating. From version 1.16.2 on, Unbound stores the start time for a query and uses that to decide if the cached delegation information can be overwritten.

• CWE-613

• https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D35CX4SCZVNKZTWJXPDFTHWZHINMGEZD/
• https://security.gentoo.org/glsa/202212-02Third Party Advisory
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D35CX4SCZVNKZTWJXPDFTHWZHINMGEZD/
• https://security.gentoo.org/glsa/202212-02Third Party Advisory
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txtVendor Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30693Information disclosure vulnerability in the system configura…5.3
• CVE-2022-30694The login endpoint /FormLogin in affected web services does …6.5
• CVE-2022-30695Local privilege escalation due to excessive permissions assi…7.8
• CVE-2022-30696Local privilege escalation due to a DLL hijacking vulnerabil…7.8
• CVE-2022-30697Local privilege escalation due to insecure folder permission…7.8
• CVE-2022-30698NLnet Labs Unbound, up to and including version 1.16.1 is vu…6.5
• CVE-2022-3070The Generate PDF WordPress plugin before 3.6 does not saniti…4.8
• CVE-2022-30700An incorrect permission assignment vulnerability in Trend Mi…7.8
• CVE-2022-30701An uncontrolled search path element vulnerability in Trend M…7.8
• CVE-2022-30702Trend Micro Security 2022 and 2021 (Consumer) is vulnerable …5.5
• CVE-2022-30703Trend Micro Security 2021 and 2022 (Consumer) is vulnerable …7.8
• CVE-2022-30704Improper initialization in the Intel(R) TXT SINIT ACM for so…6.7