EUVD-2026-66348
GHSA-m6mr-q7j3-3rc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to NSD TCP port 53
-
DeliverySend valid DNS query
-
ExploitThrottle TCP receive window to near-zero
-
ExecutionTrigger integer underflow in serve child
-
PersistServe child process crashes
-
ImpactRepeat at high rate to deny all TCP DNS service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires only the ability to open a TCP connection to the NSD server on port 53 (or whichever port NSD is configured to listen on) and manipulate the TCP receive window advertisement - a capability inherent in any standard TCP socket implementation. No authentication, no special DNS query content, and no non-default NSD configuration are required. The attack is limited to the TCP service path: UDP DNS queries are unaffected by this vulnerability. Exploitation is bounded by the attacker's ability to sustain a continuous stream of TCP connections; a single connection causes one child crash, not a persistent outage. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable by any unauthenticated remote host with TCP reachability - no complexity, no setup, no interaction required. The availability impact is rated VA:L at the vulnerable-system level, which reflects that UDP DNS service remains unaffected and the scope is confined to the TCP path only. No EPSS score was provided in the available data, so exploitation probability cannot be quantified statistically. There is no CISA KEV listing and no public proof-of-concept, indicating this has not been observed in widespread active exploitation at time of analysis. The practical risk is elevated for operators who depend on TCP for zone transfers, EDNS large-response handling, or DNS-over-TCP clients, where sustained crashing would fully deny that service tier. Operators running NSD as a hidden primary serving zone transfers to secondaries should treat this with priority, as loss of TCP would interrupt zone propagation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker opens a TCP connection to the target NSD server on port 53, sends a well-formed DNS query, and then reduces the TCP receive window advertisement to near zero, preventing NSD from flushing its response buffer. This triggers the integer underflow in the serve child, causing it to crash. By scripting this sequence at high frequency across many connections, the attacker depletes the pool of available serve children, fully denying TCP-based DNS responses for the duration of the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.
RemediationAI
Consult the NLnet Labs vendor advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt for the exact patched NSD release; the specific fixed version is not independently confirmed from the available data, so 'patch available per vendor advisory' is the appropriate characterization. While awaiting patching, operators may apply firewall rules to restrict TCP port 53 access to known-legitimate sources such as secondary name servers, resolvers, and monitoring hosts, accepting the trade-off that legitimate TCP-dependent clients outside those ranges will lose DNS connectivity. Monitoring for rapid NSD serve-child restarts or abnormal TCP connection volumes can aid in detecting exploitation attempts in progress.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NSD (Name Server Daemon) is an authoritative-only DNS server developed by NLnet Labs, widely deployed by ISPs, registries, and enterprise DNS operators. It uses a multi-process architecture in which serve child processes handle individual TCP connections. The root cause is CWE-191 (Integer Underflow/Wrap-or-Wraparound): when a TCP client throttles its receive window to a very small or zero value after delivering a query, the serve child encounters an integer underflow in its window-size tracking logic and crashes. Because NSD spawns discrete serve children per connection, an attacker can continuously trigger this crash faster than the daemon can respawn replacements. The CPE string cpe:2.3:a:nlnet_labs:nsd:*:*:*:*:*:*:*:* covers all known versions, indicating no prior-generation release is exempt.
Know when Nsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable with no authentication or complexity; availability impact is partial (TCP service only, UDP unaffected), so A:L with unchanged scope.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
1DescriptionCVE.org
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a c
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supp
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data spl
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
Exploit-DB