Executive brief
NSD is a DNS name server that handles DNS queries over TCP. A remote attacker can crash NSD server processes by artificially limiting the TCP receive window to 1 byte after sending a query, and by repeatedly doing this can completely disable TCP-based DNS service, causing legitimate DNS clients to fail to resolve domain names.
Technical details
This is a denial-of-service vulnerability in NSD's TCP query handling. The vulnerability occurs when a remote client throttles the TCP receive window (to 1 byte) after sending a TCP DNS query, causing the server child process to crash. No authentication is required; any remote network client can exploit this by repeatedly crashing NSD child processes, eventually denying all TCP service to the NSD instance. The vulnerability affects NSD versions 3.2.11 through 4.15.0. Patches are available: NSD 4.15.1 includes the fix, and a manual patch is available for version 4.15.0.
Affected products
- NLnet Labs NSD 3.2.11 to 4.15.0
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: NSD 4.15.1 released with patch; manual patch available for 4.15.0