CVE-2026-18664
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
Risk Assessment
Incorrect IP comparison can lead to security policy violations, allowing unauthorized access or blocking legitimate users.
Recommendation
Update NSD to a patched version and verify access control rules based on ranges.
Other vulnerabilities in NSD
See all- CVE-2026-101341High
A vulnerability in NSD involves text tokens in RDATA (e.g., TXT records) under 32 bytes not being checked to stay within the reserved space, allowing arbitrary sized out-of-bounds stack writes, including overwriting a callback function pointer.
- CVE-2026-101339High
A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.
- CVE-2026-101338High
A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.
- CVE-2026-101337High
A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.
- CVE-2026-19401High
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
- CVE-2026-18916High
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Original NVD description (English source)
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS