CVE catalog

CVE-2026-10846

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address

[CVE catalog]

Severity
High · CVSS 8.2
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianldnssid1.9.2-1fixed
Debianldnsforky1.9.2-1fixed
Debianldnstrixie1.8.4-2vulnerable
Debianldnsbookworm1.8.3-1vulnerable
CpeldnsNot reported1.8.3-2ubuntu0.1~esm1fixed
CpeldnsutilsNot reported1.8.3-2ubuntu0.1~esm1fixed
Cpelibldns-devNot reported1.8.3-2ubuntu0.1~esm1fixed
Cpelibldns3t64Not reported1.8.3-2ubuntu0.1~esm1fixed
Cpepython3-ldnsNot reported1.8.3-2ubuntu0.1~esm1fixed
CpeldnsNot reportedNot reportedvulnerable
CpeldnsNot reported1.9.1fixed
Opensuseldnsleap 16.01.8.4-160000.3.1fixed
Suseldnslinux enterprise server 16.01.8.4-160000.3.1fixed
Suseldnslinux enterprise server for sap applications 16.01.8.4-160000.3.1fixed
Ubuntuldnspro1.8.4-2build1vulnerable
Ubuntuldnspro1.8.4-2build3vulnerable
Ubuntuldnspro1.8.4-2ubuntu0.26.04.1~esm1fixed
Suseldnslinux enterprise module for basesystem 15 sp71.8.3-150600.3.3.1fixed
Suseldnslinux enterprise module for development tools 15 sp71.8.3-150600.3.3.1fixed
Suseldnslinux enterprise module for package hub 15 sp71.8.3-150600.3.3.1fixed
Suseldnslinux enterprise server 15 sp6-ltss1.8.3-150600.3.3.1fixed
Suseldnslinux enterprise server for sap applications 15 sp61.8.3-150600.3.3.1fixed
Suseldnslinux enterprise high performance computing 15 sp4-espos1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise high performance computing 15 sp4-ltss1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise high performance computing 15 sp5-espos1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise high performance computing 15 sp5-ltss1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise server 15 sp4-ltss1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise server 15 sp5-ltss1.7.0-150000.4.11.1fixed
Suseldnslinux enterprise server for sap applications 15 sp41.7.0-150000.4.11.1fixed
Suseldnslinux enterprise server for sap applications 15 sp51.7.0-150000.4.11.1fixed
Opensuseldnstumbleweed1.9.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianldnssourcesid1.9.2-1not yet assignedNot reported[1139627]
Debianldnssourceforky1.9.2-1not yet assignedNot reported[1139627]
Debianldnssourcetrixie(unfixed)not yet assignedNot reported[1139627]
Debianldnssourcebookworm(unfixed)not yet assignedNot reported[1139627]
CpeldnscpeNot reported1.8.3-2ubuntu0.1~esm1Not reportedNot reportedNot reported
CpeldnsutilscpeNot reported1.8.3-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Cpelibldns-devcpeNot reported1.8.3-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Cpelibldns3t64cpeNot reported1.8.3-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Cpepython3-ldnscpeNot reported1.8.3-2ubuntu0.1~esm1Not reportedNot reportedNot reported
CpeldnscpeNot reported1.9.1Not reportedNot reportedNot reported
Opensuseldnsrpmleap 16.01.8.4-160000.3.1Not reportedOPENSUSE-SU-2026:21093-1Not reported
Suseldnsrpmlinux enterprise server 16.01.8.4-160000.3.1Not reportedSUSE-SU-2026:22167-1Not reported
Suseldnsrpmlinux enterprise server for sap applications 16.01.8.4-160000.3.1Not reportedSUSE-SU-2026:22167-1Not reported
Ubuntuldnsdebpro1.8.4-2ubuntu0.26.04.1~esm1Not reportedUSN-8449-1Not reported
Suseldnsrpmlinux enterprise module for basesystem 15 sp71.8.3-150600.3.3.1Not reportedSUSE-SU-2026:2462-1Not reported
Suseldnsrpmlinux enterprise module for development tools 15 sp71.8.3-150600.3.3.1Not reportedSUSE-SU-2026:2462-1Not reported
Suseldnsrpmlinux enterprise module for package hub 15 sp71.8.3-150600.3.3.1Not reportedSUSE-SU-2026:2462-1Not reported
Suseldnsrpmlinux enterprise server 15 sp6-ltss1.8.3-150600.3.3.1Not reportedSUSE-SU-2026:2462-1Not reported
Suseldnsrpmlinux enterprise server for sap applications 15 sp61.8.3-150600.3.3.1Not reportedSUSE-SU-2026:2462-1Not reported
Suseldnsrpmlinux enterprise high performance computing 15 sp4-espos1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise high performance computing 15 sp4-ltss1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise high performance computing 15 sp5-espos1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise high performance computing 15 sp5-ltss1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise server 15 sp4-ltss1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise server 15 sp5-ltss1.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise server for sap applications 15 sp41.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Suseldnsrpmlinux enterprise server for sap applications 15 sp51.7.0-150000.4.11.1Not reportedSUSE-SU-2026:2461-1Not reported
Opensuseldnsrpmtumbleweed1.9.2-1.1Not reportedOPENSUSE-SU-2026:10998-1Not reported

[Debian bug #1139627]

Notes

[trixie] ldns: Minor issue [bookworm] ldns: Minor issue; off-path response spoofing only for apps using ldns as UDP stub resolver, e.g. drill; no addr/port/ID matching in ldns_udp_send_from

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ldnsutils]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

  • [libldns3]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

  • [libldns-dev]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

  • [python3-ldns]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Affected

      nvd · ldns · debian · bookworm; nvd · ldns · debian · 12

[Debian 13 (Trixie)]

  • [ldnsutils]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Affected

      nvd · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Affected

      nvd · ldns · debian · 13

  • [libldns3t64]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Affected

      nvd · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Affected

      nvd · ldns · debian · 13

  • [libldns-dev]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Affected

      nvd · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Affected

      nvd · ldns · debian · 13

  • [python3-ldns]Affected

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Affected

      nvd · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Affected

      nvd · ldns · debian · 13

[openSUSE Tumbleweed]

  • [ldns-devel]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.2-1.1

      Version impact unknown

      nvd · ldns · opensuse · tumbleweed

  • [libldns3]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.2-1.1

      Version impact unknown

      nvd · ldns · opensuse · tumbleweed

  • [perl-DNS-LDNS]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.2-1.1

      Version impact unknown

      nvd · ldns · opensuse · tumbleweed

  • [python3-ldns]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.2-1.1

      Version impact unknown

      nvd · ldns · opensuse · tumbleweed

  • [ldns]Fixed

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 1.9.2-1.1

      nvd · ldns · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]