FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Insufficient response validation in the ldns stub resolver

Affected packages
15.0 <= FreeBSD < 15.0_10
14.4 <= FreeBSD < 14.4_6
14.3 <= FreeBSD < 14.3_15

Details

VuXML ID fc0c7763-6477-11f1-958d-bc241121aa0a
Discovery 2026-06-09
Entry 2026-06-10

Problem Description:

When used as a stub resolver over UDP, ldns failed to verify that a received response belonged to the outstanding query. It did not check that the response source address and port matched the query destination, that the transaction ID matched, or that the question section of the response matched that of the query.

Impact:

Without these checks, an off-path attacker who cannot observe the query can forge UDP responses that ldns will accept as genuine. By injecting spoofed replies, the attacker can return arbitrary DNS data to any program that uses ldns for stub resolving, including drill(1).

References

CVE Name CVE-2026-10846
FreeBSD Advisory SA-26:36.ldns