ldns 1.9.2 is available:
https://nlnetlabs.nl/downloads/ldns/ldns-1.9.2.tar.gz
sha256 b524fa21994b6e834200ceb8c27f1b84bda5982fe35706f058196c079db94d5d
pgp https://nlnetlabs.nl/downloads/ldns/ldns-1.9.2.tar.gz.asc
This release has a single security fix, CVE-2026-10846:
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality, vulnerable for off-path poisoning attacks.
The drill tool, which is shipped with ldns and uses ldns for stub resolving, inherently suffers from this vulnerability too.
Please do not install ldns version 1.9.1 as it has a wrong .so version. Install ldns version 1.9.2 instead.
The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026:
User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45
The key is available from NLnet Labs - Software Signing Keys
Bug fix:
-
Fix CVE-2026-10846: Insufficient verification that responses belong to a query. Thanks Pablo Ruiz from ‘codecome.ai’ for the report
-
Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will be reserved for a future 1.10.0 release