NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ldnsUpgrade ldns-docUpgrade ldns-utilsUpgrade ldns-develUpgrade python3-ldnsUpgrade perl-ldns | Aug 4, 2026 | Aug 3, 2026 |
| Freebsd | — | Upgrade FreeBSDUpgrade ldns | Jun 23, 2026 | Jun 23, 2026 |
| Redhat_linux | — | Upgrade python3-ldns-debuginfoUpgrade ldns-debuginfoUpgrade ldnsUpgrade ldns-develUpgrade perl-ldns-debuginfoUpgrade ldns-utilsUpgrade ldns-docUpgrade perl-ldnsNo solution existsUpgrade ldns-debugsourceUpgrade ldns-utils-debuginfoUpgrade python3-ldns | Jul 17, 2026 | Jun 10, 2026 |
| Rocky_linux | — | Upgrade ldns-debugsourceUpgrade python3-ldns-debuginfoUpgrade python3-ldnsUpgrade ldns-utils-debuginfoUpgrade ldns-utilsUpgrade ldns-debuginfoUpgrade perl-ldnsUpgrade perl-ldns-debuginfoUpgrade ldns-develUpgrade ldns | Aug 6, 2026 | Aug 4, 2026 |
| Ubuntu | — | Upgrade libldns3 (Ubuntu Pro)Upgrade libldns3t64 (Ubuntu Pro)Upgrade ldnsutils (Ubuntu Pro)Upgrade libldns1 (Ubuntu Pro)Upgrade libldns2 (Ubuntu Pro) | Jun 18, 2026 | Jun 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub