CVE-2026-19401
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Risk Assessment
A remote attacker can cause denial of service for DNS, potentially disrupting the entire network infrastructure.
Recommendation
Update NSD to a patched version and avoid using debugging builds in production.
Other vulnerabilities in NSD
See all- CVE-2026-18916Medium
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
- CVE-2026-18664High
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
Original NVD description (English source)
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.