CVE-2026-10846: Insufficient verification that responses belong to a query

Synopsis

This is a DNS response validation bypass in NLnet Labs ldns, a DNS library used as a stub resolver over UDP. The flaw is reachable over the network with no authentication required, and stems from ldns failing to verify that a DNS response matches its originating query by checking the source address, source port, query ID, or question section. A successful off-path attacker can inject forged DNS responses, causing applications using ldns for resolution to cache and act on attacker-controlled records, enabling DNS cache poisoning. A patched-image rebuild at version 1.9.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send UDP packets to the resolving application over the network; no local or physical access is needed.

• AuthenticationNot required

  No authentication or existing account is needed; the attack is available to any off-path network actor.

• Victim interactionNot required

  No user action is required; the application's normal DNS resolution process is sufficient to trigger the vulnerable code path.

• Attack complexityDetail

  Base exploit logic is condition-free and reliable, though the CVSS AT:P token indicates that a specific deployment condition (the application performing UDP-based stub resolution) must be present for the attack to succeed.

Blast Radius

• An attacker poisons the DNS resolution cache used by the affected application, redirecting domain lookups to attacker-controlled IP addresses.
• Traffic intended for legitimate services is silently rerouted, enabling interception or manipulation of application-layer connections built on those lookups.
• The drill tool shipped with ldns is directly affected, so any tooling or scripts that invoke drill for DNS queries are exposed to the same poisoning risk.