CVE-2026-18916
Fixed in a distro release EPSS <1%CVSS 6.9
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Products: NLnet Labs NSD
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nsd | no fix |
| Debian 13 | nsd | no fix |
| Debian 14 | nsd | 4.15.1-1 |
| Ubuntu 26.10 | nsd | no fix |
| Ubuntu Pro 16.04 LTS | nsd | no fix |
| Ubuntu Pro 18.04 LTS | nsd | no fix |
| Ubuntu Pro 20.04 LTS | nsd | no fix |
| Ubuntu Pro 22.04 LTS | nsd | no fix |
| Ubuntu Pro 24.04 LTS | nsd | no fix |
| Ubuntu Pro 26.04 LTS | nsd | no fix |