Executive brief
NSD is a DNS nameserver that uses IP address ranges to control which systems are allowed or denied access. On little-endian systems (common in Intel/AMD processors), a bug in how NSD compares IP addresses causes the access control rules to be applied incorrectly. This means attackers from IP addresses that should be blocked could gain access, while legitimate users from allowed IPs might be denied service.
Technical details
The vulnerability is an endianness mismatch in IPv4 and IPv6 range comparison logic for access control rules. IPv4 ranges are compared as unsigned 32-bit integers using the host's native endianness, but the values being compared are in network byte order (big-endian), causing incorrect matches on little-endian systems. IPv6 suffers the same issue when comparing four 32-bit values. An attacker can craft IP addresses that bypass intended access restrictions without authentication or special preconditions. The vulnerability affects NSD versions 3.0.0 through 4.15.0; patches are available in version 4.15.1 and as a backport for 4.15.0.
Affected products
- NLnet Labs NSD 3.0.0 to 4.15.0
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: NSD 4.15.1 released with fix; patch available for 4.15.0