CVE-2026-19401
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Risk Assessment
A remote attacker can cause denial of service for DNS, potentially disrupting the entire network infrastructure.
Recommendation
Update NSD to a patched version and avoid using debugging builds in production.
Other vulnerabilities in NSD
See all- CVE-2026-18664Critical
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
- CVE-2026-18916High
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Original NVD description (English source)
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS