What’s Vulnerable › Vulnerabilities
CVE-2026-19401: Remote UDP DoS by sending multiple DNS Cookie options
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-26 · updated 2026-09-08
- Weakness: CWE-400
Description
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Affected products
- NLnet Labs NSD: from 4.3.7 before 4.15.1 — fixed in 4.15.1
How to fix
Upgrade to a fixed version: NLnet Labs NSD 4.15.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19401 or the next vulnerability affects your stack