Critical ldns Vulnerability: Off-path Poisoning Attack Risk
Summary
ALSA-2026:50108: Important: ldns security update. Affects ldns versions < 1.7.1-12.el9_8.1. Fixed in 1.7.1-12.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ldns package is a library designed to simplify DNS programming in C, supporting all low-level DNS and DNSSEC operations. It provides a higher-level API for developers to create or sign DNS packets efficiently. However, a recent security issue has been identified that compromises its integrity, making it susceptible to off-path poisoning attacks due to insufficient query-response matching.
Vulnerability Detail
The vulnerability, identified as CVE-2026-10846, arises from inadequate matching between DNS queries and responses. This flaw allows an attacker to exploit the system by injecting malicious responses, potentially leading to data interception or manipulation. The ramifications of this vulnerability can be severe, affecting the reliability and security of DNS operations.
How To Fix
Minimum fixed version
1.7.1-12.el9_8.1
This is the first release that contains the fix.
sudo dnf update ldnsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The ldns package has a critical vulnerability that poses significant risks to DNS operations. It is crucial to update to the patched version to mitigate these risks. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for ldns →
FAQ
ldns is a library that simplifies DNS programming in C, providing support for DNS and DNSSEC operations.
CVE-2026-10846 is the identifier for a security vulnerability in the ldns package that allows off-path poisoning attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential data interception and manipulation due to the ability of attackers to inject malicious DNS responses.
You can update the ldns package by running 'sudo dnf update ldns ldns-devel ldns-doc ldns-utils perl-ldns python3-ldns' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for ldns.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
