CVE-2026-18664
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
Risk Assessment
Incorrect IP comparison can lead to security policy violations, allowing unauthorized access or blocking legitimate users.
Recommendation
Update NSD to a patched version and verify access control rules based on ranges.
Other vulnerabilities in NSD
See all- CVE-2026-19401High
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
- CVE-2026-18916Medium
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Original NVD description (English source)
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.