CVE-2026-10846: NLnet Labs ldns DNS Poisoning Vulnerability

CVE-2026-10846 Overview

CVE-2026-10846 is a DNS response validation flaw in NLnet Labs ldns, a widely used DNS library. The vulnerability affects ldns versions 1.2.0 through 1.9.0 when applications use the library as a stub resolver over UDP. The library fails to validate that the response source address, source port, query ID, and question section match the original query. The drill diagnostic tool shipped with ldns inherits the same flaw. Off-path attackers can inject forged DNS responses and poison resolver caches or steer applications to attacker-controlled hosts. The weakness maps to [CWE-346: Origin Validation Error].

Critical Impact
Off-path attackers can forge DNS responses accepted by ldns-based stub resolvers, enabling DNS cache poisoning and redirection of application traffic.

Affected Products

NLnet Labs ldns 1.2.0 through 1.9.0
Applications linking ldns as a stub resolver over UDP
The drill DNS diagnostic tool bundled with ldns

Discovery Timeline

2026-06-10 - CVE-2026-10846 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-10846

Vulnerability Analysis

The vulnerability resides in the UDP stub resolver code path of ldns. A correct DNS client must verify several fields when accepting a UDP response: the source IP and port must match the destination of the outgoing query, the 16-bit transaction ID must match the query ID, and the question section must mirror the original question. ldns performs none of these checks in the affected versions. Any UDP datagram arriving on the listening socket can be treated as a valid answer to an outstanding query. This removes the fundamental entropy DNS relies on to defend against blind response injection.

Root Cause

The root cause is missing origin validation in the response-handling logic of the stub resolver. The implementation accepts the first UDP datagram received without correlating it to the query state. Standards including RFC 5452 require resolvers to validate transaction ID, question tuple, and the network 5-tuple. Skipping these checks reduces the attacker's required guesswork to essentially zero.

Attack Vector

An off-path attacker who can predict or observe that a victim application is about to issue a DNS query sends spoofed UDP responses to the victim's resolver port. Because ldns does not match the response to the query, the forged answer is accepted. The attacker injects arbitrary A, AAAA, MX, or TXT records, redirecting subsequent application traffic to attacker-controlled infrastructure. The attack requires no privileges, no user interaction, and no on-path position. Technical details are documented in the NLnet Labs CVE-2026-10846 Notes and the OpenWall OSS Security Update.

Detection Methods for CVE-2026-10846

Indicators of Compromise

Unexpected DNS responses arriving at hosts running ldns-based applications from IP addresses other than the configured resolver.
Applications resolving known domains to unexpected IP addresses or geographies.
Bursts of inbound UDP/53 traffic targeting ephemeral ports of client processes that link ldns.

Detection Strategies

Inventory all binaries linking libldns and identify versions 1.2.0 through 1.9.0 using package managers or ldd output.
Compare DNS responses observed on the wire against the authoritative answers from a trusted recursive resolver to surface inconsistencies.
Monitor for drill invocations in production environments where the tool is not expected.

Monitoring Recommendations

Log and alert on DNS responses whose source address differs from the configured stub resolver.
Enable passive DNS collection and flag sudden changes in A/AAAA records for sensitive domains.
Track UDP/53 response volume per client process and alert on anomalies consistent with response flooding.

How to Mitigate CVE-2026-10846

Immediate Actions Required

Upgrade ldns to a fixed release as published by NLnet Labs and rebuild or update all dependent applications.
Restrict use of drill for diagnostics until the patched version is deployed.
Force stub resolvers to use TCP or DNS over TLS where the application supports it, removing exposure to UDP response spoofing.

Patch Information

NLnet Labs has published advisory details and fixed builds at the NLnet Labs CVE-2026-10846 Notes. Distribution maintainers are tracking the fix through the OpenWall OSS Security Update. Apply vendor packages once available and verify the installed ldns version is greater than 1.9.0.

Workarounds

Route DNS queries from affected applications through a local trusted resolver such as unbound listening on 127.0.0.1, which performs full response validation.
Enforce egress firewall rules permitting UDP/53 only to approved resolver IP addresses to reduce off-path injection surface.
Where feasible, switch the application to a DNS library that validates the transaction ID, question, and 5-tuple.

bash

# Configuration example: force ldns-based apps through a validating local resolver
echo 'nameserver 127.0.0.1' | sudo tee /etc/resolv.conf
sudo systemctl enable --now unbound
# Verify installed ldns version
ldns-config --version