EUVD-2026-66349
GHSA-v29p-5fvf-m7p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable debug-build NSD server
-
DeliveryCraft UDP DNS packet with exactly 17 Cookie options and 512-byte payload
-
ExploitSend to port 53
-
ExecutionTrigger reachable assertion in serve child
-
PersistServe child process aborts
-
ImpactRepeat continuously to sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | The mandatory prerequisite is that NSD must be running as a debug or non-release build - release builds compiled without debug assertions are not vulnerable. The attacker must have network connectivity to UDP port 53 of the affected server. The specific trigger requires a DNS message containing exactly 17 DNS Cookie option records (RFC 7873) combined with a UDP payload size of 512 bytes; other Cookie option counts or payload sizes do not trigger the assertion. Exploitation is limited by the debug-build requirement, which is a non-default deployment condition unlikely to exist in production environments following standard build practices. There is no required authentication (PR:N in CVSS 4.0) and no user interaction needed once network access to the target is established. |
| Impact | The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) accurately captures the network-accessible, unauthenticated attack vector while the AT:P (Attack Requirements: Present) metric encodes the critical limiting condition - the debug build prerequisite. Real-world risk is substantially lower than the numerical score implies: production deployments built with standard release flags are not vulnerable, and internet-facing debug builds represent a small, atypical population. No EPSS data was provided, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. Availability impact is high within the affected population, but that population is narrow. Organizations following standard build hygiene face minimal realistic risk; the primary concern is development/CI/QA environments or non-standard deployments where debug builds may inadvertently face network exposure. |
| Exploit ScenarioDerived | An attacker sends a continuous stream of crafted UDP DNS packets - each containing exactly 17 DNS Cookie option records and a 512-byte UDP payload - to port 53 of a debug-build NSD instance reachable over the network. Each packet triggers the reachable assertion in the serve child process, aborting it; the parent daemon respawns children, but sustained flooding outpaces recovery, denying DNS service to all legitimate clients. No authentication, prior access, or public exploit code is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
RemediationAI
The primary remediation is to ensure NSD is compiled and deployed exclusively as a release build. Any internet-facing or production-adjacent NSD instance running a debug build should be immediately rebuilt as a release build or taken offline until rebuilt. Consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt for any patched release version details - a patched version, if available, eliminates the vulnerability regardless of build type. As a compensating control, applying network-level ACLs to restrict which source IPs can send UDP queries to port 53 of the affected server reduces exposure, with the trade-off of limiting legitimate DNS reachability for an authoritative server. Disabling DNS Cookie support at the configuration level, if NSD supports this option, would remove the vulnerable code path while potentially impacting clients relying on Cookie-based query validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NSD (Name Server Daemon) is an authoritative-only DNS server developed by NLnet Labs, widely deployed in internet infrastructure. The root cause is CWE-617 (Reachable Assertion): an assertion check exists in the serve child process code path that fires when processing DNS Cookie options (defined in RFC 7873) under a very specific combination - exactly 17 Cookie option records in a message with a 512-byte UDP payload size. In release builds, such assertions are compiled out and the code path is unreachable by attacker input. In debug builds, the assertion is live and reachable from the network. The serve child is the worker process handling incoming DNS queries; crashing it disrupts query processing until the parent respawns it, and repeated crashes outpace respawning. The CPE cpe:2.3:a:nlnet_labs:nsd:*:*:*:*:*:*:*:* indicates a broad version range shares this code pattern.
Know when Nsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
AC:H captures the debug-build prerequisite outside attacker control; S:U and A:H reflect child process crash with no confidentiality or integrity impact.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Executive ViewAI
NSD authoritative DNS servers can be remotely crashed by unauthenticated attackers via specially crafted DNS messages, causing complete DNS resolution service denial. However, this vulnerability affects only non-production (debug/development) builds; standard production release builds are immune. Organizations must verify their NSD deployment types and eliminate non-production builds from operational use.
No vendor-released patch identified at time of analysis. Mitigations: (1) deploy only production release builds of NSD; (2) implement DNS query rate limiting to reduce attack effectiveness; (3) restrict authoritative DNS server access to trusted internal networks; (4) establish monitoring and alerting on NSD process crashes and restarts to detect attack attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a c
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supp
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data spl
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
Exploit-DB