Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-18664— Wrong interpretation of ACL ranges

Quick assessment

Affected
NLnet Labs NSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当使用地址范围进行访问控制（例如格式为 1.2.3.4-1.2.3.25）时，由于 NSD 在小端序（little-endian）系统上错误地将 IP 地址与该范围进行比较，可能导致本应允许访问的 IP 被拒绝，而本应被禁止访问的 IP 却被允许访问。 具体来说，IPv4 地址的比较是作为无符号 32 位整数直接进行的，但比较过程中直接使用了主机的大小端序（endianness），而实际待比较的值是以网络字节序（大端序，big-endian）存储的。对于 IPv6 地址，其比较过程涉及四次无符号 32 位整数比较，

CVSS 8.2 · High EPSS 0.32% · P24

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
NLnet Labs NSD 3.0.0< 4.15.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18664

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wrong interpretation of ACL ranges
Source: CVE Program / CVE List V5
Vulnerability Description
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs NSD 3.0.0 ~ 4.15.1 -

II. Public POCs for CVE-2026-18664

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18664

请登录查看更多情报信息。

Other References for CVE-2026-18664 (1)

Same Patch Batch · NLnet Labs · 2026-08-26 · 4 CVEs total

CVE-2026-19401 8.2 HIGH Remote UDP DoS by sending multiple DNS Cookie options
CVE-2026-19538 8.2 HIGH Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
CVE-2026-18916 6.9 MEDIUM Remote TCP DoS by throttling the TCP receive window

IV. Related Vulnerabilities

Same product: NSD
Same vendor: NLnet Labs
Same weakness: CWE-284

V. Comments for CVE-2026-18664

No comments yet

Leave a comment