VDB
RHSA-2026:54244
RHSA-2026:54244
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol (UDP), it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This vulnerability allows a remote attacker to perform off-path poisoning attacks, potentially leading to DNS cache poisoning and redirection to malicious resources.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | ldns-debugsource-0:1.7.1-11.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | perl-ldns-debuginfo-0:1.7.1-11.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-debuginfo-0:1.7.1-11.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | python3-ldns-debuginfo-0:1.7.1-11.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | perl-ldns-debuginfo-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-0:1.7.1-11.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-debuginfo-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-debuginfo-0:1.7.1-11.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | perl-ldns-debuginfo-0:1.7.1-11.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-utils-debuginfo-0:1.7.1-11.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-0:1.7.1-11.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-0:1.7.1-11.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | python3-ldns-debuginfo-0:1.7.1-11.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | perl-ldns-debuginfo-0:1.7.1-11.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-utils-debuginfo-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | python3-ldns-debuginfo-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-0:1.7.1-11.el9_4.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-utils-debuginfo-0:1.7.1-11.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
| Red Hat | ldns-debugsource-0:1.7.1-11.el9_4.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 1.7.1-11.el9 |
…and 11 more
Timeline
- Aug 12, 2026 CVE Published
- Aug 12, 2026 CVE Updated
- Aug 12, 2026 Distribution Patch
- Aug 12, 2026 Distribution Patch
- Aug 12, 2026 Security Advisory
- Aug 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54244 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487437 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54244.json advisory
- https://access.redhat.com/security/cve/CVE-2026-10846 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-10846 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10846 advisory
- https://www.nlnetlabs.nl/downloads/ldns/CVE-2026-10846.txt advisory