Critical ldns Vulnerability: Off-path Poisoning Attack Risk
Summary
ALSA-2026:49836: Important: ldns security update. Affects ldns versions < 1.8.3-18.el10_2.1. Fixed in 1.8.3-18.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ldns package is a library designed to simplify DNS programming in C, supporting all low-level DNS and DNSSEC operations. It also provides a higher-level API for creating and signing packets, making it a vital tool for developers working with DNS functionalities. However, a recent vulnerability has been identified that compromises its security, specifically related to query-response matching.
Vulnerability Detail
The vulnerability identified as CVE-2026-10846 in the ldns package allows for off-path poisoning attacks due to insufficient query-response matching. This flaw can enable attackers to manipulate DNS responses, potentially leading to unauthorized access or data interception. The vulnerability arises from the library's failure to adequately verify that the response received corresponds to the original query sent, which can be exploited by malicious actors.
How To Fix
Minimum fixed version
1.8.3-18.el10_2.1
This is the first release that contains the fix.
sudo dnf update ldnsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The ldns package has a critical vulnerability that poses significant risks to DNS operations. Users are strongly advised to update to the latest patched version to secure their applications against potential attacks. Regular monitoring and updates are essential to maintain security in open-source software.
See every vulnerability recorded for ldns →
FAQ
ldns is a library that simplifies DNS programming in C, supporting low-level DNS and DNSSEC operations.
CVE-2026-10846 refers to a vulnerability in the ldns package that allows for off-path poisoning attacks due to insufficient query-response matching.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to sensitive data and the possibility of data interception, which can compromise the integrity of DNS operations.
Yes, a patch is available in version 1.8.3-18.el10_2.1 of the ldns package. Users should update to this version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for ldns.
