CVE-2026-19401CWE-400CWE-617denial-of-service

CVE-2026-19401

High · published August 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-617 · Reachable Assertion
Published
2026-08-26T13:16Z
Affected products (1)
ProductVersionsFixed in
nlnetlabs/nsd≥ 4.3.7, < 4.15.14.15.1
References (1)
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt · [email protected]
EPSS history
Timeline
  • 27 AUG 06:20Z
    EPSS moved — → 0%
    epss
  • 26 AUG 08:44Z
    Remote UDP DoS by sending multiple DNS Cookie options
    cvelistv5