CVE-2026-18916

Awaiting Analysis Awaiting Analysis - Queue

NSD DNS Server TCP Throttling Denial of Service

Publication date: 2026-08-26

Last updated on: 2026-09-08

Assigner: NLnet Labs

Description

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-08

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-18916

EUVD

EUVD-2026-66348

Affected Vendors & Products

Vendor	Product	Version / Range
nlnetlabs	nsd	From 3.2.11 (inc) to 4.15.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote attacker to crash the NSD server process by manipulating the TCP receive window after sending a TCP query. By repeatedly crashing the server processes, the attacker can prevent the NSD instance from responding to legitimate TCP requests, effectively denying service to all TCP clients.

Detection Guidance

Monitor NSD server logs for repeated crashes of child processes. Check for unusual TCP traffic patterns or connection drops during queries. Use network monitoring tools to detect sustained throttling of TCP receive windows.

Impact Analysis

If you rely on NSD for DNS services, this vulnerability could disrupt your DNS resolution for TCP-based queries. This may cause intermittent or complete outages for services dependent on DNS, leading to degraded performance or loss of connectivity for users.

Compliance Impact

This vulnerability causes a denial of TCP service for NSD instances, which could disrupt DNS resolution. For compliance with GDPR or HIPAA, availability of DNS services is critical for logging, authentication, and secure communications. A prolonged outage may impact data processing or system integrity requirements.

Mitigation Strategies

Apply the latest NSD security patches immediately. Restrict TCP-based DNS queries if possible. Implement rate limiting on DNS servers to prevent abuse. Monitor server stability closely after applying fixes.

Hi! I’m here to help you understand CVE-2026-18916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70