CVE-2026-19401 is a high severity (CVSS 7.5) denial of service in NLnet Labs NSD. A remote client can crash a serve child of a debugging or non-release build by sending a query with a specific number of DNS Cookie options. NSD 4.3.7 through 4.15.0 are affected, and 4.15.1 fixes it.
What's affected
NLnet Labs' advisory says NSD 4.3.7 through 4.15.0, inclusive, is affected and that NSD 4.15.1 is released with the patch. The advisory notes that the crash affects debugging or non-release build types, so a normal release build is not the target. The advisory gives no CVSS score. The 7.5 score in the record is from NVD and reflects a network attack that needs no privileges and affects availability only.
For 4.15.0, the advisory provides a patch file, patch_CVE-2026-19401.diff, which you apply from the source directory with patch -p1 and then install with make install. It says the patch was tested on 4.15.0. The sibling issue CVE-2026-18916 affects TCP service and is fixed in the same release.
How to check if you're exposed
Check the NSD version:
nsd -v
Then find out whether your binary is a debug or non-release build. Packaged builds from distributions are normally release builds, while builds you compile yourself with debugging options enabled are not. If you compile NSD, check the configure options and the build notes you kept.
If you build with debugging on in production, the check is simple: you are in scope until you upgrade or patch.
What to do now
- Inventory NSD instances, their versions and how each was built.
- Upgrade to NSD 4.15.1, which also fixes CVE-2026-18916.
- If you run 4.15.0, apply the advisory's patch file and rebuild.
- Stop running debug builds in production, and use release builds.
- Keep a second name server on a different build so DNS stays up if one crashes.
- Watch for repeated serve child restarts.
Why it matters
The weaknesses are CWE-400 (uncontrolled resource consumption) and CWE-617 (reachable assertion). In a debug build, an assertion stops the process when a condition the developers thought impossible turns out to be true. A message with a particular count of DNS Cookie options, tuned to the UDP payload size, makes that condition true, so the process aborts.
In a release build the assertion is not compiled in, which is why the advisory limits the issue to debug builds. The lesson for operators is practical: debug builds carry checks that turn bad input into crashes. A remote client that repeats the message can hamper or, from a close enough network position, deny DNS service. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect normal release builds?
The advisory says the crash affects debugging or non-release build types.
How do I fix NSD 4.15.0 without upgrading?
Apply patch_CVE-2026-19401.diff from the advisory with patch -p1 in the source directory, then run make install.
Sources
Last reviewed: 18 October 2026.
