# CVE-2026-10846: Insufficient verification that responses belong to a query

CVE-2026-10846 is fixed in 11 products on 1 platform, first by ldnsutils 1.8.4-2ubuntu0.26.04.1~esm1, released June 9, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-10846
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0015
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 9, 2026
- Weakness: Origin Validation Error
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10846

## Description

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ldns Debian 14 | 1.9.2-1 | [DEBIAN-CVE-2026-10846](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10846.md) | Jun 24, 2026 |
| Linux | ldns RHEL 10 | 1.8.3-18.el10_0.1 | [RHSA-2026:53402](https://patchblox.com/security/data/fix/linux/rhsa-2026-53402.md) | Jun 10, 2026 |
| Linux | ldns RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | ldns RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | ldns almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | ldns almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | ldns ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | ldns ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |
| Linux | ldns opensuse-leap 16.0 | 1.8.4-160000.3.1 | [OPENSUSE-SU-2026:21093-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21093-1.md) | Jun 18, 2026 |
| Linux | ldns rocky 10 | 0:1.8.3-18.el10_2.1 | [RLSA-2026:49836](https://patchblox.com/security/data/fix/linux/rlsa-2026-49836.md) | Aug 6, 2026 |
| Linux | ldns rocky 8 | 0:1.7.0-23.el8_10 | [RLSA-2026:49520](https://patchblox.com/security/data/fix/linux/rlsa-2026-49520.md) | Aug 4, 2026 |
| Linux | ldns rocky 9 | 0:1.7.1-12.el9_8.1 | [RLSA-2026:50108](https://patchblox.com/security/data/fix/linux/rlsa-2026-50108.md) | Aug 6, 2026 |
| Linux | ldns sles 15.6 | 1.8.3-150600.3.3.1 | [SUSE-SU-2026:2462-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2462-1.md) | Jun 19, 2026 |
| Linux | ldns sles 15.7 | 1.8.3-150600.3.3.1 | [SUSE-SU-2026:2462-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2462-1.md) | Jun 19, 2026 |
| Linux | ldns sles 16.0 | 1.8.4-160000.3.1 | [SUSE-SU-2026:22167-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22167-1.md) | Jun 18, 2026 |
| Linux | ldns-devel RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | ldns-devel RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | ldns-devel almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-devel almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | ldns-devel almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | ldns-devel ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-devel ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | ldns-devel ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |
| Linux | ldns-doc RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | ldns-doc RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | ldns-doc almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-doc almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | ldns-doc almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | ldns-doc ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-doc ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | ldns-doc ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |
| Linux | ldns-utils RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | ldns-utils RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | ldns-utils almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-utils almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | ldns-utils almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | ldns-utils ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | ldns-utils ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | ldns-utils ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |
| Linux | ldnsutils Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | [ldnsutils 1.7.0-3ubuntu4.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ldnsutils-1.7.0-3ubuntu4.1-esm1.md) | Jun 24, 2026 |
| Linux | ldnsutils Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | [ldnsutils 1.7.0-4.1ubuntu1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ldnsutils-1.7.0-4.1ubuntu1-esm2.md) | Jun 24, 2026 |
| Linux | ldnsutils Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | [ldnsutils 1.7.1-2ubuntu4+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ldnsutils-1.7.1-2ubuntu4-esm2.md) | Jun 24, 2026 |
| Linux | ldnsutils Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | [ldnsutils 1.8.3-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ldnsutils-1.8.3-2ubuntu0.1-esm1.md) | Jun 24, 2026 |
| Linux | ldnsutils Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | [ldnsutils 1.8.4-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ldnsutils-1.8.4-2ubuntu0.26.04.1-esm1.md) | Jun 9, 2026 |
| Linux | libldns2 Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | [libldns2 1.7.0-3ubuntu4.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libldns2-1.7.0-3ubuntu4.1-esm1.md) | Jun 24, 2026 |
| Linux | libldns2 Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | [libldns2 1.7.0-4.1ubuntu1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libldns2-1.7.0-4.1ubuntu1-esm2.md) | Jun 24, 2026 |
| Linux | libldns3 Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | [libldns3 1.7.1-2ubuntu4+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libldns3-1.7.1-2ubuntu4-esm2.md) | Jun 24, 2026 |
| Linux | libldns3t64 Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | [libldns3t64 1.8.3-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libldns3t64-1.8.3-2ubuntu0.1-esm1.md) | Jun 24, 2026 |
| Linux | libldns3t64 Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | [libldns3t64 1.8.4-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libldns3t64-1.8.4-2ubuntu0.26.04.1-esm1.md) | Jun 9, 2026 |
| Linux | perl-ldns RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | perl-ldns RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | perl-ldns almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | perl-ldns almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | perl-ldns almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | perl-ldns ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | perl-ldns ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | perl-ldns ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |
| Linux | python-ldns Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | [python-ldns 1.7.0-3ubuntu4.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-ldns-1.7.0-3ubuntu4.1-esm1.md) | Jun 24, 2026 |
| Linux | python-ldns Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | [python-ldns 1.7.0-4.1ubuntu1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-ldns-1.7.0-4.1ubuntu1-esm2.md) | Jun 24, 2026 |
| Linux | python3-ldns RHEL 8 | 0:1.7.0-23.el8_10 | [RHSA-2026:49520](https://patchblox.com/security/data/fix/linux/rhsa-2026-49520.md) | Aug 5, 2026 |
| Linux | python3-ldns RHEL 9 | 0:1.7.1-12.el9_8.1 | [RHSA-2026:50108](https://patchblox.com/security/data/fix/linux/rhsa-2026-50108.md) | Aug 5, 2026 |
| Linux | python3-ldns Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu4.1+esm1 | [python3-ldns 1.7.0-3ubuntu4.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-ldns-1.7.0-3ubuntu4.1-esm1.md) | Jun 24, 2026 |
| Linux | python3-ldns Ubuntu 20.04 LTS (focal) | 1.7.0-4.1ubuntu1+esm2 | [python3-ldns 1.7.0-4.1ubuntu1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-ldns-1.7.0-4.1ubuntu1-esm2.md) | Jun 24, 2026 |
| Linux | python3-ldns Ubuntu 22.04.1 LTS (jammy) | 1.7.1-2ubuntu4+esm2 | [python3-ldns 1.7.1-2ubuntu4+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-ldns-1.7.1-2ubuntu4-esm2.md) | Jun 24, 2026 |
| Linux | python3-ldns Ubuntu 24.04.5 LTS (noble) | 1.8.3-2ubuntu0.1~esm1 | [python3-ldns 1.8.3-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-ldns-1.8.3-2ubuntu0.1-esm1.md) | Jun 24, 2026 |
| Linux | python3-ldns Ubuntu 26.04.1 LTS (resolute) | 1.8.4-2ubuntu0.26.04.1~esm1 | [python3-ldns 1.8.4-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-ldns-1.8.4-2ubuntu0.26.04.1-esm1.md) | Jun 9, 2026 |
| Linux | python3-ldns almalinux 10 | 1.8.3-18.el10_2.1 | [ALSA-2026:49836](https://patchblox.com/security/data/fix/linux/alsa-2026-49836.md) | Aug 3, 2026 |
| Linux | python3-ldns almalinux 8 | 1.7.0-23.el8_10 | [ALSA-2026:49520](https://patchblox.com/security/data/fix/linux/alsa-2026-49520.md) | Aug 3, 2026 |
| Linux | python3-ldns almalinux 9 | 1.7.1-12.el9_8.1 | [ALSA-2026:50108](https://patchblox.com/security/data/fix/linux/alsa-2026-50108.md) | Aug 4, 2026 |
| Linux | python3-ldns ol 10 | 0:1.8.3-18.el10_2.1 | [ELSA-2026-49836](https://patchblox.com/security/data/fix/linux/elsa-2026-49836.md) | Aug 3, 2026 |
| Linux | python3-ldns ol 8 | 0:1.7.0-23.el8_10 | [ELSA-2026-49520](https://patchblox.com/security/data/fix/linux/elsa-2026-49520.md) | Aug 4, 2026 |
| Linux | python3-ldns ol 9 | 0:1.7.1-12.el9_8.1 | [ELSA-2026-50108-0](https://patchblox.com/security/data/fix/linux/elsa-2026-50108-0.md) | Aug 4, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.