CVE-2026-19401 PUBLISHED

Remote UDP DoS by sending multiple DNS Cookie options

Assigner: NLnet Labs
Reserved: 10.08.2026 Published: 26.08.2026 Updated: 26.08.2026

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.2

Remote client denying UDP availability by sending a special crafted message to a debugging build type NSD instance

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

Remote client denying UDP availability by sending a special crafted message to a debugging build type NSD instance

CVSS 4.0

Product Status

Vendor	NLnet Labs
Product	NSD
Versions	Default: unaffected affected from 4.3.7 to 4.15.1 (excl.)

Solutions

This issue is fixed in 4.15.1 and all later versions.

Credits

Qifan Zhang from Palo Alto Networks finder
afldl <zhangph@yandex.com> finder

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt

Problem Types

CWE-617 Reachable Assertion CWE
CWE-400 Uncontrolled Resource Consumption CWE