Critical Security Update for ldns Package: Off-path Poisoning Vulnerability
Summary
ALSA-2026:49520: Important: ldns security update. Affects ldns versions < 1.7.0-23.el8_10. Fixed in 1.7.0-23.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ldns package is a library designed to simplify DNS programming in C, supporting all low-level DNS and DNSSEC operations. It provides a higher-level API that enables developers to create and sign DNS packets easily. However, a recent vulnerability has been identified that compromises the integrity of DNS queries, potentially allowing attackers to manipulate DNS responses.
Vulnerability Detail
The vulnerability, identified as CVE-2026-10846, stems from insufficient query-response matching in the ldns library. This flaw allows for off-path poisoning attacks, where an attacker can exploit the mismatch to inject malicious responses into the DNS resolution process. The ramifications of this vulnerability can lead to unauthorized access to sensitive information, redirection of users to malicious sites, and overall compromise of network security.
How To Fix
Minimum fixed version
1.7.0-23.el8_10
This is the first release that contains the fix.
sudo dnf update ldnsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it becomes available.
Conclusion
The ldns package has a critical vulnerability that could allow attackers to perform off-path poisoning attacks. It is imperative for users to update their packages to the latest version to protect against potential exploits. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for ldns →
FAQ
ldns is a library that simplifies DNS programming in C, providing support for DNS and DNSSEC operations.
CVE-2026-10846 refers to a specific vulnerability in the ldns package that allows for off-path poisoning attacks due to insufficient query-response matching.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities in real-time.
The vulnerability can lead to unauthorized access, redirection to malicious sites, and compromise of network security.
While there are no specific workarounds, it is crucial to prioritize the update to the patched version to mitigate risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ldns.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
