VulnSocial

CVE-2026-10846Disclosure(nlnetlabs / ldns)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nlnetlabs ldns systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.

nlnetlabs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ldns

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-10); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
nlnetlabs
Products
ldns

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-10: 2Mentions · 2026-06-18: 1Patch / Workaround · 2026-06-18: 1Technical Details · 2026-06-10: 2Technical Details · 2026-06-18: 106-1006-18
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-102
Disclosure2
2026-06-181
Patch1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Patch

    CVE-2026-10846: ldns insufficiently verifies that responses belong to a query https://www.openwall.com/lists/oss-security/2026/06/10/2 NLnet Labs ldns 1.2.0 to 1.9.0, when used in applications as (stub) resolver over UDP, makes them vulnerable to off-path poisoning attacks. Fixed in 1.9.1. Patch attached.

    Post summary

    A CVE affecting ldns 1.2.0‑1.9.0 allows off‑path poisoning; the flaw is fixed in 1.9.1 and a patch is provided.

    00030284
    4.7K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-10846 NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port… https://www.cve.org/CVERecord?id=CVE-2026-10846 ----- Traducción: CVE-2026-10846 NLn… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑10846 affecting ldns 1.2.0‑1.9.0, noting a missing match on the query destination address and port for UDP stub resolvers.

    0000026
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-10846 NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port… https://www.cve.org/CVERecord?id=CVE-2026-10846

    Post summary

    A brief announcement of CVE-2026-10846, detailing a flaw in ldns stub resolvers that fails to verify query destination address and port over UDP.

    00000164
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnlnetlabsldns---

Explore more

Back to dashboardnlnetlabs CVEsldns vulnerabilities