A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.
A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.
Insufficient verification that responses belong to a query
When a zone file in ldns 1.7.1 is parsed, the function ldnsnsec3saltdata is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldnsrdfsize(saltrdf) byte data can be copied, causing heap overflow information leakage.
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
Heap-based buffer overflow in the ldnsrrnewfrmstrinternal function in ldns before 1.6.11 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Resource Record (RR) with an unknown type containing input that is longer than a specified length.
When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
The CVE number for this vulnerability will be CVE-2026-10846
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Score: 8.2, Severity: High
== Summary == Affected products ldns 1.2.0 up to and including 1.9.0
== Description
== Solution Or apply the patch manually. For ldns 1.9.0 the patch is attached as patchcve2026-10846.diff
Apply the patch on ldns source directory with: 'patch -p0 < patchcve2026-10846.diff' then run 'make install' to install ldns.
== Acknowledgments