Is CVE-2026-79981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79981 being exploited in the wild.

How severe is CVE-2026-79981?

Medium severity, with a CVSS score of 6.5, published 23 October 2026.

Which products and versions are affected?

Zephyr OS before the fix implementing CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT.

How is CVE-2026-79981 attacked?

It is attacked over the network or from the adjacent network, in an operating system.

Am I affected by CVE-2026-79981?

Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79981: Zephyr DNS resolver predictable source port and transaction ID

CVE-2026-79981 · Severity: medium · CVSS 6.5 · Published 2026-10-23

Zephyr's DNS resolver uses a fixed UDP source port and predictable transaction identifiers when performing DNS queries, making it vulnerable to DNS spoofing attacks. An attacker on the same network or with UDP reachability to the device can forge DNS responses and redirect the device to attacker-controlled addresses. This could lead to users accessing malicious websites or services that appear legitimate.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-79981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79981 being exploited in the wild.
How severe is CVE-2026-79981?: Medium severity, with a CVSS score of 6.5, published 23 October 2026.
Which products and versions are affected?: Zephyr OS before the fix implementing CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT.
Is there a fix for CVE-2026-79981?: Yes: fixed in Zephyr versions with CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT enabled (default enabled); the fix randomizes the source port before each query by unregistering and re-registering the dispatcher with a fresh ephemeral port.. Until then: Enable CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT in the Zephyr build configuration (enabled by default). Restrict UDP reachability to the device where possible. Applications should validate TLS certificates for resolved endpoints to mitigate successful DNS spoofing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79981 attacked?: It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-79981?: Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr versions with CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT enabled (default enabled); the fix randomizes the source port before each query by unregistering and re-registering the dispatcher with a fresh ephemeral port.

Enable CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT in the Zephyr build configuration (enabled by default). Restrict UDP reachability to the device where possible. Applications should validate TLS certificates for resolved endpoints to mitigate successful DNS spoofing.

Technical details

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds a single UDP socket per configured server with an ephemeral port that remains constant for the resolver context lifetime, and draws transaction identifiers from a predictable 16-bit space (sys_rand16_get()). RFC 5452 §9.2 requires both to vary. An off-path attacker with UDP reachability can observe a query to learn the port, then flood forged DNS responses with varying transaction IDs during the query window to win the race against the legitimate server; the resolver accepts replies based solely on transaction ID and name CRC-16 without validating source address.

Affected products

Zephyr Zephyr OS before the fix implementing CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT

Timeline

2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.