CVE-2026-18916 PUBLISHED

Remote TCP DoS by throttling the TCP receive window

Assigner: NLnet Labs
Reserved: 05.08.2026 Published: 26.08.2026 Updated: 26.08.2026

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Remote client denying TCP availability by throttling the TCP receive window (down to 1 byte)

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	Low	Availability	None
Privileges Required	None
User Interaction	None

Remote client denying TCP availability by throttling the TCP receive window (down to 1 byte)

CVSS 4.0

Product Status

Vendor	NLnet Labs
Product	NSD
Versions	Default: unaffected affected from 3.2.11 to 4.15.1 (excl.)

Solutions

This issue is fixed in 4.15.1 and all later versions.

Credits

Akhil Koul (https://github.com/akoul) finder

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt

Problem Types

CWE-191: Integer Underflow CWE