CVE-2026-10846: CWE-346 Origin Validation Error in NLnet Labs ldns
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
AI Analysis
Technical Summary
The vulnerability in NLnet Labs ldns (CVE-2026-10846) affects versions 1.2.0 up to and including 1.9.0. When used as a stub resolver over UDP, ldns does not verify that the response source address and port match the query destination address and port. Additionally, it fails to match the query ID and question with those in the response. This lack of origin validation (CWE-346) enables off-path attackers to inject malicious DNS responses, leading to potential cache poisoning. The drill tool shipped with ldns is also vulnerable. There is no vendor advisory or patch available at this time.
Potential Impact
This vulnerability allows an unauthenticated, off-path attacker to spoof DNS responses to a stub resolver using ldns over UDP. By exploiting the lack of validation of response origin and query matching, attackers can poison DNS caches, potentially redirecting users to malicious sites or disrupting DNS resolution. The CVSS 4.0 score is 8.2 (high severity), reflecting the network attack vector, low complexity, no privileges required, and high impact on integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider using alternative DNS resolver implementations that perform strict response validation or deploy additional network-level protections to mitigate off-path spoofing risks.
CVE-2026-10846: CWE-346 Origin Validation Error in NLnet Labs ldns
Description
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
CVSS v4.0
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in NLnet Labs ldns (CVE-2026-10846) affects versions 1.2.0 up to and including 1.9.0. When used as a stub resolver over UDP, ldns does not verify that the response source address and port match the query destination address and port. Additionally, it fails to match the query ID and question with those in the response. This lack of origin validation (CWE-346) enables off-path attackers to inject malicious DNS responses, leading to potential cache poisoning. The drill tool shipped with ldns is also vulnerable. There is no vendor advisory or patch available at this time.
Potential Impact
This vulnerability allows an unauthenticated, off-path attacker to spoof DNS responses to a stub resolver using ldns over UDP. By exploiting the lack of validation of response origin and query matching, attackers can poison DNS caches, potentially redirecting users to malicious sites or disrupting DNS resolution. The CVSS 4.0 score is 8.2 (high severity), reflecting the network attack vector, low complexity, no privileges required, and high impact on integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider using alternative DNS resolver implementations that perform strict response validation or deploy additional network-level protections to mitigate off-path spoofing risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-06-04T12:06:54.996Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2907048dd33fbd85fa8695
Added to database: 06/10/2026, 06:41:08 UTC
Last enriched: 06/17/2026, 08:54:26 UTC
Last updated: 07/19/2026, 17:26:46 UTC
Views: 100
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.