CVE-2026-18916
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Risk Assessment
The attack can lead to unavailability of DNS services based on NSD, affecting name resolution in the network and potentially disrupting DNS-dependent applications.
Recommendation
Apply vendor patches for NSD. Restrict TCP service access to trusted clients and monitor for unusual network behavior.
Other vulnerabilities in NSD
See all- CVE-2026-19401High
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
- CVE-2026-18664High
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
Original NVD description (English source)
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.