Summary
Pablo Ruiz discovered that ldns did not properly validate DNS
responses when used as a stub resolver over UDP. A remote
attacker could possibly use this issue to inject arbitrary DNS
responses.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ldns | 1.6.17-8ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ldns | 1.7.0-3ubuntu4.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ldns | 1.7.0-4.1ubuntu1+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ldns | 1.7.1-2ubuntu4+esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | ldns | 1.8.3-2ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | ldns | 1.8.4-2ubuntu0.26.04.1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-10846