CVE-2026-18916

A vulnerability in NSD involves text tokens in RDATA (e.g., TXT records) under 32 bytes not being checked to stay within the reserved space, allowing arbitrary sized out-of-bounds stack writes, including overwriting a callback function pointer.

A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.

A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.

A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.

When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.