The ldns library, which simplifies DNS programming in C and supports DNS/DNSSEC operations, contains a vulnerability (CVE-2026-10846) that allows off-path poisoning attacks. This occurs because of insufficient matching between DNS queries and responses, potentially enabling attackers to inject malicious DNS responses. Red Hat has issued security advisories (RHSA-2026:49520 for RHEL 8 and RHSA-2026:49836 for RHEL 10) with updated ldns packages that fix this issue. The advisories cover multiple architectures including x86_64, s390x, ppc64le, and aarch64. The fix involves improved query-response matching to prevent off-path poisoning. No known exploits are reported in the wild at this time.

The vulnerability allows off-path attackers to perform DNS poisoning attacks by exploiting insufficient query-response matching in the ldns library. This could lead to the injection of malicious DNS responses, potentially redirecting users or services to attacker-controlled addresses. The issue affects multiple architectures and versions of Red Hat Enterprise Linux 8 and 10. The security impact is rated as important/high by Red Hat Product Security.

Red Hat has released official security updates for ldns in Red Hat Enterprise Linux 8 and 10 that address CVE-2026-10846. Users should apply these updates promptly to remediate the vulnerability. Detailed update instructions are available in Red Hat's advisory and article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor beyond applying the provided patches.