CVE-2026-10846

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1084608.1Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.CVE-2026-1084617.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1084625.5Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose infor CVE-2026-1084638.8Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1084647.0Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.CVE-2026-1084657.0Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.CVE-2026-1084665.3Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.CVE-2026-1084678.8Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.CVE-2026-1084687.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-1084696.8Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allo CVE-2026-108477.8A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able CVE-2026-1084706.5Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose info