Bug 2487437 (CVE-2026-10846)

Summary:	CVE-2026-10846 ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alebedev, jmitchel, kshier, rhel-process-autobot, sdawley, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol (UDP), it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This vulnerability allows a remote attacker to perform off-path poisoning attacks, potentially leading to DNS cache poisoning and redirection to malicious resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2500365, 2500378, 2500383, 2500367, 2500376, 2500381
Bug Blocks:

Description OSIDB Bzimport 2026-06-10 07:01:26 UTC

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.

Comment 4 errata-xmlrpc 2026-08-03 04:46:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:49520 https://access.redhat.com/errata/RHSA-2026:49520

Comment 5 errata-xmlrpc 2026-08-03 23:55:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:49836 https://access.redhat.com/errata/RHSA-2026:49836

Comment 6 errata-xmlrpc 2026-08-04 16:31:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:50108 https://access.redhat.com/errata/RHSA-2026:50108

Comment 7 errata-xmlrpc 2026-08-11 11:10:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:53402 https://access.redhat.com/errata/RHSA-2026:53402

Comment 8 errata-xmlrpc 2026-08-12 09:13:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:54244 https://access.redhat.com/errata/RHSA-2026:54244

Comment 9 errata-xmlrpc 2026-08-12 11:03:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:54254 https://access.redhat.com/errata/RHSA-2026:54254

Comment 10 errata-xmlrpc 2026-08-12 14:14:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:54377 https://access.redhat.com/errata/RHSA-2026:54377