CVE-2026-18916 is a high severity (CVSS 7.5) denial of service in NLnet Labs NSD. A remote client can crash a serve child by throttling the TCP receive window after a TCP query, and by repeating that deny all TCP service. NSD 3.2.11 through 4.15.0 are affected, and 4.15.1 fixes it.
What's affected
NLnet Labs' advisory says NSD 3.2.11 through 4.15.0, inclusive, is affected, and that NSD 4.15.1 is released with the patch. The advisory itself gives no severity or CVSS score. The 7.5 score in the record comes from NVD and reflects a network attack with no privileges that affects availability only.
For NSD 4.15.0 the advisory also provides a patch file. Apply it from the NSD source directory with patch -p1, then run make install. The advisory says it was tested on 4.15.0. Many operating systems package NSD, so also watch your distribution for an updated package.
How to check if you're exposed
Check the version of NSD on each name server:
nsd -v
If the version is between 3.2.11 and 4.15.0, you are affected. For packaged installs, query your package manager, for example dpkg -l nsd or rpm -q nsd, and compare with your distribution's security notes.
Then note whether you serve TCP. The flaw affects TCP service, so authoritative servers that must answer large responses over TCP are exposed. Monitor for serve child processes that restart repeatedly.
What to do now
- Inventory every NSD instance and its version.
- Upgrade to NSD 4.15.1, or install your distribution's patched package.
- If you run 4.15.0 from source and cannot upgrade yet, apply the patch file from the advisory.
- Restart NSD and check that serve children stay up under normal load.
- Keep a second name server on a different software or network path so DNS survives a crash.
- Watch logs for repeated child crashes.
Why it matters
The weakness class is CWE-191, integer underflow. Somewhere in the TCP handling, a counter or size goes below zero in an unsigned type when the client slows its receive window, and the process fails. The advisory describes the result as a crash of the serve child rather than anything beyond that.
The danger is repetition. A single crash is recoverable, but a client that keeps sending the pattern can keep serve children down and deny TCP service to the instance. DNS is infrastructure that other systems depend on, so even an availability only flaw has wide reach. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect UDP queries?
The advisory describes denial of TCP service. A related flaw, CVE-2026-19401, concerns UDP and applies only to debug builds.
Is there a patch for 4.15.0 without upgrading?
Yes. The advisory provides a patch file, tested on 4.15.0, to apply with patch -p1 and make install.
Sources
Last reviewed: 18 October 2026.
