CVE-2026-18664
Received Received - Intake

IPv4/IPv6 Access Control Bypass in NSD

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: NLnet Labs

Description
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-18664
EUVD
EUVD-2026-66347

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects IP address range comparisons in NSD's access control. When ranges like 1.2.3.4-1.2.3.25 are used, the system incorrectly compares IP addresses on little endian systems due to endianness issues. This can lead to unintended access denials or allowances because IPv4 addresses are compared as unsigned 32-bit numbers with host endianness instead of network byte order.

Detection Guidance

This vulnerability affects IP range comparisons in NSD's access control. Detection requires checking if your NSD configuration uses IP ranges (e.g., 1.2.3.4-1.2.3.25) and verifying if the system is little-endian. Inspect NSD configuration files for range-based access rules. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause unauthorized access to systems or services if IP ranges are used for access control. Legitimate users may be blocked while unauthorized users may gain access, depending on the system's endianness. The high CVSS score (8.2) indicates significant potential impact on confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. Unauthorized access may result in data breaches, which are subject to strict reporting and mitigation obligations under these regulations.

Mitigation Strategies

Immediate mitigation involves avoiding IP range-based access control in NSD configurations. Replace ranges with individual IP addresses or CIDR notation. Update NSD to the latest version if a patch is available. Monitor for unexpected access denials or allowances.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart