Summary
The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets.
Security Fix(es):
* ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | ldns | 0:1.7.1-12.el9_8.1 |
Vulnerabilities 1
-
High 8.2
Insufficient verification that responses belong to a query
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the questio…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2487437