EUVD-2026-66348Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or complexity; availability impact is partial (TCP service only, UDP unaffected), so A:L with unchanged scope.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
AnalysisAI
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only the ability to open a TCP connection to the NSD server on port 53 (or whichever port NSD is configured to listen on) and manipulate the TCP receive window advertisement - a capability inherent in any standard TCP socket implementation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable by any unauthenticated remote host with TCP reachability - no complexity, no setup, no interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NLnet Labs vendor advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt for the exact patched NSD release; the specific fixed version is not independently confirmed from the available data, so 'patch available per vendor advisory' is the appropriate characterization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a deni
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today