CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916 Remote TCP DoS by throttling the TCP receive window

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916 Remote TCP DoS by throttling the TCP receive window

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18664 Wrong interpretation of ACL ranges

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664 Wrong interpretation of ACL ranges

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664

NSD (Name Server Daemon) by NLnet Labs contains an endianness bug in its ACL range comparison logic. On little-endian systems, IPv4 and IPv6 addresses are compared against access-control ranges (e.g., 1.2.3.4–1.2.3.25) using host endianness, while the values are stored in network byte order (big-...

CVE-2026-18664

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

PT-2026-81986

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

PT-2026-81987

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

CVE-2026-18916: Integer Underflow (Wrap or Wraparound)

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

NSD -- multiple vulnerabilities

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics. CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window down to 1. Reported b...

CVE-2026-19401: Reachable Assertion

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

PT-2026-81985

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664: Improper Access Control

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

OPENSUSE-SU-2026:21502-1 Security update for nsd

This update for nsd fixes the following issues: Changes in nsd: - Update nsd.keyring - update to 4.14.3: https://github.com/NLnetLabs/nsd/blob/NSD4143REL/doc/ChangeLog CVE-2026-12490: Bypass of client certificate verification with transfer over TLS bsc1269563 CVE-2026-12246: Out of bounds stack...

Security update for nsd (important)

openSUSE Security Update: Security update for nsd Announcement ID: openSUSE-SU-2026:0265-1 Rating: important References: 1269563 1269564 1269565 1269566 Cross-References: CVE-2026-12244 CVE-2026-12245 CVE-2026-12246 CVE-2026-12490 Affected Products: openSUSE Backports SLE-15-SP7 An update that...

OPENSUSE-SU-2026:11395-1 nsd-4.14.3-1.1 on GA media

These are all security issues fixed in the nsd-4.14.3-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : nsd (2026-2843bb1cc8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2843bb1cc8 advisory. Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Thanks to Qifan Zhang, Palo...