EUVD-2026-66347Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires non-default range-based ACL configuration on a little-endian host (AC:H); no authentication needed (PR:N); impact is confidentiality-only with no scope change.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
3DescriptionCVE.org
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
AnalysisAI
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following conditions simultaneously: (1) NSD is configured with ACL rules using hyphen-range IP notation (e.g., 1.2.3.4-1.2.3.25) - sites using only CIDR notation or single-host entries are NOT affected; (2) the NSD instance is running on a little-endian architecture (x86, x86-64, or ARM LE) - big-endian deployments are not affected; and (3) the attacker's source IP falls within the address space that the endianness-swapped comparison erroneously accepts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.2, reflecting network-accessible, unauthenticated exploitation with high confidentiality impact, moderated by the AT:P (Attack Requirements: Present) qualifier that correctly captures the conditional nature of the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply the vendor-released patch from NLnet Labs, documented at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18664.txt. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all NSD configurations to identify instances of range-based IP ACLs (hyphen syntax) and document which zones and operations are exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a deni
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today