NSD -- multiple vulnerabilities

2026-08-27 · CVE-2026-18664, CVE-2026-18916, CVE-2026-19401, CVE-2026-19538 · VuXML entry

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks , Claude and Ada Logics . CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window (down to 1). Reported by akoul (Akhil Koul) CVE-2026-19401: Any remote client can denial UDP service by sending a specifically crafted query …

Affected versions

• nsd < 4.15.1

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.