CVE-2026-18664 is a critical access control flaw (CVSS 9.1) in NLnet Labs NSD, the authoritative DNS server. On little endian systems, IP ranges used in access control lists are compared wrongly, so addresses meant to be allowed may be denied and addresses meant to be denied may be allowed. Upgrade to NSD 4.15.1.
What's affected
NSD from 3.0.0 up to and including 4.15.0 is affected, per the NLnet Labs advisory. The issue appears when you write ranges in the form 1.2.3.4-1.2.3.25 in access control. It happens on little endian hosts, which includes x86 and most ARM systems.
Single addresses and prefix style entries are not described as affected in the advisory text. Check the advisory for the exact scope.
How to check if you're exposed
Print the installed version:
nsd -v
Then search your configuration for range entries, meaning two addresses joined by a hyphen, in options such as notify, provide-xfr, allow-notify and request-xfr:
grep -rnE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' /etc/nsd/
If you find none and use no IPv6 ranges, the flaw has nothing to act on. Upgrade anyway.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Run nsd -v on every name server and note versions from 3.0.0 to 4.15.0.
- Upgrade to NSD 4.15.1. If you build from source on 4.15.0, NLnet Labs also publishes a patch, linked in the advisory.
- Until you upgrade, replace address ranges with prefix notation or single addresses.
- Review zone transfer and notify logs for requests from addresses that should not have been allowed.
Why it matters
The advisory explains the cause. An IPv4 address is compared with a range as an unsigned 32 bit number using the host's byte order, but the stored values are in network byte order, which is big endian. IPv6 is compared as four 32 bit parts with the same mistake. The comparison is therefore wrong on little endian hardware. The classes are CWE-284, improper access control, and CWE-697, incorrect comparison.
The damage depends on what your ACLs guard. If they gate zone transfers or notifications, a wrong answer can let an unintended host in or lock a legitimate secondary out. The CVE is not in CISA's KEV list.
A note on byte order
Byte order bugs rarely show up in testing on one machine, and tests that only run on big endian or only on little endian can both pass while the other fails. If you maintain network code, add a test that compares addresses and ranges after converting both sides to the same order.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I never use ranges?
The advisory describes the bug for range based access control. Without ranges the comparison is not used, but upgrading is still sensible.
Which version fixes it?
NSD 4.15.1, per NLnet Labs.
Sources
Last reviewed: 19 October 2026.
