Skip to content
OpenAdvisories
High ELSA-2026-49520 1 CVE

Important: ldns security update (Oracle Linux 8)

Published Aug 4, 2026 · Updated Aug 4, 2026

Ecosystem: Oracle Linux

Summary

[1.7.0-23]
- Fix CVE-2026-10846: validate DNS response source address, transaction
ID, and query section matching
- Resolves: RHEL-210700

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 8 ldns 0:1.7.0-23.el8_10
Oracle Linux · 8 ldns-devel 0:1.7.0-23.el8_10
Oracle Linux · 8 ldns-doc 0:1.7.0-23.el8_10
Oracle Linux · 8 ldns-utils 0:1.7.0-23.el8_10
Oracle Linux · 8 perl-ldns 0:1.7.0-23.el8_10
Oracle Linux · 8 python3-ldns 0:1.7.0-23.el8_10

Vulnerabilities 1

  • High 8.2
    CVE-2026-10846

    Insufficient verification that responses belong to a query

    NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the questio…

    NLnet Labs ldns ldns ldns Debian Ubuntu Azure Linux