CVE-2026-19401— Remote UDP DoS by sending multiple DNS Cookie options
Quick assessment
Affected
NLnet Labs NSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
任何远程客户端都可以通过发送一条精心构造的消息，导致运行调试版或非发布版类型的 NSD 服务子进程崩溃。该消息包含一个经过特殊调优的 DNS Cookie 选项数量（当 UDP 负载大小为 512 字节时，该数量为 17）。通过持续崩溃这些服务子进程，远程客户端可以严重阻碍 DNS 服务的正常运行；如果攻击者位于网络拓扑中足够靠近目标的位置，甚至可能导致所有 DNS 服务完全不可用。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | NSD | 4.3.7< 4.15.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote UDP DoS by sending multiple DNS Cookie options
Source: CVE Program / CVE List V5
Vulnerability Description
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | NSD | 4.3.7 ~ 4.15.1 | - |
|
II. Public POCs for CVE-2026-19401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19401
请登录查看更多情报信息。
Other References for CVE-2026-19401 (1)
-
🔗 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt vendor-advisory
Same Patch Batch · NLnet Labs · 2026-08-26 · 4 CVEs total
| CVE-2026-18664 | 8.2 HIGH | Wrong interpretation of ACL ranges |
| CVE-2026-19538 | 8.2 HIGH | Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS |
| CVE-2026-18916 | 6.9 MEDIUM | Remote TCP DoS by throttling the TCP receive window |
IV. Related Vulnerabilities
Same product: NSD
-
CVE-2026-19538
Bypass of BLOCKED ACL items on proxy protocol port over TCP -
CVE-2026-18916
Remote TCP DoS by throttling the TCP receive window -
CVE-2026-18664
Wrong interpretation of ACL ranges -
CVE-2026-12490
Bypass of client certificate verification with transfer over -
CVE-2026-12246
Out of bounds stack write with crafted APL RR
Same vendor: NLnet Labs
-
CVE-2026-19538
Bypass of BLOCKED ACL items on proxy protocol port over TCP -
CVE-2026-18916
Remote TCP DoS by throttling the TCP receive window -
CVE-2026-18664
Wrong interpretation of ACL ranges -
CVE-2026-56444
Degradation of resolution service when 'discard-timeout' and -
CVE-2026-56416
Possible heap buffer overflow when validator canonicalizes R
Same weakness: CWE-617
-
CVE-2026-53532
OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted -
CVE-2026-78186
Open5GS HSS hss-cx-path.c assertion -
CVE-2026-63388
Libevent: Heap out-of-bounds write in bufferevent_socket_set -
CVE-2026-76926
Reachable Assertion in Wireshark -
CVE-2026-62377
libheif: Reachable assertion in HeifContext::get_track() abo
V. Comments for CVE-2026-19401
No comments yet