CVE-2026-10846
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in the ldns library (versions 1.2.0 to 1.9.0) used as a UDP resolver lacks verification of the response source address and port, as well as the query ID and question. This enables off-path DNS cache poisoning attacks.
Risk Assessment
The organization risks that an attacker can redirect DNS traffic to malicious servers, potentially leading to phishing or data interception.
Recommendation
Update the ldns library to version 1.9.1 or later, which contains the security fix. Consider using a more secure resolver.
Other vulnerabilities in ldns
See all- CVE-2017-1000232Critical
CVE-2017-1000232 describes a double-free vulnerability in str2host.c in version 1.7.0 of the ldns library. The impact and attack vectors are unspecified.
- CVE-2017-1000231Critical
CVE-2017-1000231 describes a double-free vulnerability in parse.c in version 1.7.0 of the ldns library. The impact and attack vectors are unspecified.
Original NVD description (English source)
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.