Executive brief
A vulnerability in the ldns library, which is used by applications to translate human-readable domain names into IP addresses, allows attackers to redirect internet traffic. By sending fraudulent responses to network queries, an attacker could trick a system into connecting to a malicious server instead of the intended destination. This could lead to users being directed to phishing sites or the interception of sensitive communications.
Technical details
The ldns library (versions 1.2.0 to 1.9.0) fails to perform essential validation on DNS responses when operating as a stub resolver over UDP. Specifically, the library does not verify that the response source address and port match the query destination, nor does it validate the Query ID or the question section of the DNS packet. This lack of origin validation (CWE-346) allows a remote, unauthenticated attacker to perform off-path DNS poisoning. By successfully spoofing a DNS response, an attacker can redirect application traffic to arbitrary IP addresses. The included 'drill' tool is also confirmed to be affected.
Affected products
- NLnet Labs ldns 1.2.0 through 1.9.0
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory