The ldns library, which simplifies DNS programming in C and supports DNS/DNSSEC operations, contains a vulnerability (CVE-2026-10846) that allows off-path poisoning attacks due to insufficient query-response matching. This security flaw could be exploited to poison DNS responses. Red Hat has released an important security update for ldns packages in Red Hat Enterprise Linux 8 to mitigate this issue. The advisory references Red Hat's errata RHSA-2026:49520 and provides updated packages for various architectures. No CVSS score is provided in the advisory, but the severity is rated as important/high by Red Hat. The vendor advisory includes instructions for applying the update and links to further details.

The vulnerability allows off-path poisoning attacks, which can undermine the integrity of DNS responses processed by applications using the ldns library. This can lead to incorrect DNS data being accepted, potentially redirecting users or services to malicious destinations. The impact is significant enough for Red Hat to rate the update as important, indicating a high security risk if unpatched.

Red Hat has released an official security update for ldns in Red Hat Enterprise Linux 8 to address CVE-2026-10846. Users should apply the update as described in the Red Hat advisory RHSA-2026:49520 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided update is the recommended mitigation. No additional mitigation steps are indicated by the vendor advisory.