RHSA-2026:98131: Important: ldns security update
The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets.Security Fix(es): ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ldnsto a version that resolves this vulnerability.Fixed in 1.6.16-10.el7_9.1 - Upgrade
Upgrade
redhat/ldns-debuginfoto a version that resolves this vulnerability.Fixed in 1.6.16-10.el7_9.1 - Upgrade
Upgrade
redhat/ldns-develto a version that resolves this vulnerability.Fixed in 1.6.16-10.el7_9.1 - Upgrade
Upgrade
redhat/ldns-docto a version that resolves this vulnerability.Fixed in 1.6.16-10.el7_9.1 - Upgrade
Upgrade
redhat/ldns-pythonto a version that resolves this vulnerability.Fixed in 1.6.16-10.el7_9.1
Event History
Frequently Asked Questions
What systems are affected by this advisory?
The advisory applies to Red Hat ldns packages, including ldns, ldns-debuginfo, ldns-devel, ldns-python, and ldns-doc.
What type of attack does this update address?
It addresses off-path DNS poisoning attacks caused by insufficient matching between DNS queries and responses.
What should teams prioritize when triaging this issue?
Prioritize systems that use the ldns library for DNS or DNSSEC operations, particularly where applications issue DNS queries and consume their responses.