CVE-2026-10846
Insufficient verification that responses belong to a query
CVE-2026-10846 is fixed in 11 products on 1 platform, first by ldnsutils 1.8.4-2ubuntu0.26.04.1~esm1, released June 9, 2026. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0015
3rd percentile
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ldns · Debian 14 | 1.9.2-1 | DEBIAN-CVE-2026-10846 | Jun 24, 2026 |
| ldns · RHEL 10 | 1.8.3-18.el10_0.1 | RHSA-2026:53402 | Jun 10, 2026 |
| ldns · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| ldns · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| ldns · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| ldns · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| ldns · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| ldns · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| ldns · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| ldns · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
| ldns · opensuse-leap 16.0 | 1.8.4-160000.3.1 | OPENSUSE-SU-2026:21093-1 | Jun 18, 2026 |
| ldns · rocky 10 | 0:1.8.3-18.el10_2.1 | RLSA-2026:49836 | Aug 6, 2026 |
| ldns · rocky 8 | 0:1.7.0-23.el8_10 | RLSA-2026:49520 | Aug 4, 2026 |
| ldns · rocky 9 | 0:1.7.1-12.el9_8.1 | RLSA-2026:50108 | Aug 6, 2026 |
| ldns · sles 15.6 | 1.8.3-150600.3.3.1 | SUSE-SU-2026:2462-1 | Jun 19, 2026 |
| ldns · sles 15.7 | 1.8.3-150600.3.3.1 | SUSE-SU-2026:2462-1 | Jun 19, 2026 |
| ldns · sles 16.0 | 1.8.4-160000.3.1 | SUSE-SU-2026:22167-1 | Jun 18, 2026 |
| ldns-devel · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| ldns-devel · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| ldns-devel · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| ldns-devel · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| ldns-devel · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| ldns-devel · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| ldns-devel · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| ldns-devel · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
| ldns-doc · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| ldns-doc · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| ldns-doc · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| ldns-doc · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| ldns-doc · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| ldns-doc · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| ldns-doc · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| ldns-doc · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
| ldns-utils · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| ldns-utils · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| ldns-utils · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| ldns-utils · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| ldns-utils · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| ldns-utils · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| ldns-utils · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| ldns-utils · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
| ldnsutils · Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | ldnsutils 1.7.0-3ubuntu4.1+esm1 | Jun 24, 2026 |
| ldnsutils · Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | ldnsutils 1.7.0-4.1ubuntu1+esm2 | Jun 24, 2026 |
| ldnsutils · Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | ldnsutils 1.7.1-2ubuntu4+esm2 | Jun 24, 2026 |
| ldnsutils · Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | ldnsutils 1.8.3-2ubuntu0.1~esm1 | Jun 24, 2026 |
| ldnsutils · Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | ldnsutils 1.8.4-2ubuntu0.26.04.1~esm1 | Jun 9, 2026 |
| libldns2 · Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | libldns2 1.7.0-3ubuntu4.1+esm1 | Jun 24, 2026 |
| libldns2 · Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | libldns2 1.7.0-4.1ubuntu1+esm2 | Jun 24, 2026 |
| libldns3 · Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | libldns3 1.7.1-2ubuntu4+esm2 | Jun 24, 2026 |
| libldns3t64 · Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | libldns3t64 1.8.3-2ubuntu0.1~esm1 | Jun 24, 2026 |
| libldns3t64 · Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | libldns3t64 1.8.4-2ubuntu0.26.04.1~esm1 | Jun 9, 2026 |
| perl-ldns · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| perl-ldns · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| perl-ldns · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| perl-ldns · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| perl-ldns · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| perl-ldns · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| perl-ldns · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| perl-ldns · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
| python-ldns · Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | python-ldns 1.7.0-3ubuntu4.1+esm1 | Jun 24, 2026 |
| python-ldns · Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | python-ldns 1.7.0-4.1ubuntu1+esm2 | Jun 24, 2026 |
| python3-ldns · RHEL 8 | 0:1.7.0-23.el8_10 | RHSA-2026:49520 | Aug 5, 2026 |
| python3-ldns · RHEL 9 | 0:1.7.1-12.el9_8.1 | RHSA-2026:50108 | Aug 5, 2026 |
| python3-ldns · Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | python3-ldns 1.7.0-3ubuntu4.1+esm1 | Jun 24, 2026 |
| python3-ldns · Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | python3-ldns 1.7.0-4.1ubuntu1+esm2 | Jun 24, 2026 |
| python3-ldns · Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | python3-ldns 1.7.1-2ubuntu4+esm2 | Jun 24, 2026 |
| python3-ldns · Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | python3-ldns 1.8.3-2ubuntu0.1~esm1 | Jun 24, 2026 |
| python3-ldns · Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | python3-ldns 1.8.4-2ubuntu0.26.04.1~esm1 | Jun 9, 2026 |
| python3-ldns · almalinux 10 | 1.8.3-18.el10_2.1 | ALSA-2026:49836 | Aug 3, 2026 |
| python3-ldns · almalinux 8 | 1.7.0-23.el8_10 | ALSA-2026:49520 | Aug 3, 2026 |
| python3-ldns · almalinux 9 | 1.7.1-12.el9_8.1 | ALSA-2026:50108 | Aug 4, 2026 |
| python3-ldns · ol 10 | 0:1.8.3-18.el10_2.1 | ELSA-2026-49836 | Aug 3, 2026 |
| python3-ldns · ol 8 | 0:1.7.0-23.el8_10 | ELSA-2026-49520 | Aug 4, 2026 |
| python3-ldns · ol 9 | 0:1.7.1-12.el9_8.1 | ELSA-2026-50108-0 | Aug 4, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.