NLnet Labs ldns EUVD-2026-35991

Exploitation requires that the victim application use ldns 1.2.0-1.9.0 specifically as a UDP stub resolver (the bug does not affect TCP queries or non-stub usage), and that the attacker can send UDP packets to the host running the resolver while a query is outstanding - i.e., off-path spoofing toward the client's listening socket. The attacker must also induce or anticipate the target lookup so a query window is open, but no authentication, no user interaction beyond triggering a resolution, and no special privileges are required (PR:N/UI:N); the CVSS AT:P flag reflects the need for an in-flight query and successful race against the legitimate response. Deployments that already force TCP, validate DNSSEC at the application layer, or proxy DNS through a hardened local recursive resolver materially limit exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) signals network-reachable, unauthenticated exploitation with low attack complexity but with attack requirements present, which correctly captures that the attacker must race or guess against a pending query window - classic off-path Kaminsky-style conditions. Integrity impact is rated High (VI:H) with no confidentiality or availability impact, consistent with a poisoning rather than RCE/DoS primitive. EPSS and KEV data were not provided in the input, and no public proof-of-concept is referenced, so prioritization should be driven by exposure (any application linking vulnerable ldns for UDP resolution, especially long-running daemons and the drill CLI used in operations) rather than by observed exploitation. The realistic risk is moderate-to-high for systems where ldns-resolved answers feed authentication, certificate validation, or routing decisions; lower where DNSSEC validation occurs downstream or TCP is enforced.

An attacker who can predict or trigger a DNS lookup by an ldns-backed application (for example, an operator running drill, or a service resolving a controlled hostname) floods the client's source port with crafted UDP datagrams bearing plausible answers for the target QNAME; because ldns does not verify the response 5-tuple, transaction ID, or question section, the first arriving datagram is accepted and its RDATA is returned to the calling application. The attacker uses this to substitute A/AAAA, MX, SRV, or TXT records, redirecting traffic, breaking email or TLS trust anchors, or feeding malicious data into downstream logic. No public exploit is identified at time of analysis, but the technique is a well-understood off-path poisoning pattern with abundant prior art.