CVE-2026-18916: NSD Server DOS Vulnerability via TCP Attack

CVE-2026-18916 Overview

CVE-2026-18916 is a denial-of-service vulnerability in NLnet Labs Name Server Daemon (NSD), an authoritative DNS server. A remote client can crash an NSD serve child process by throttling the TCP receive window after issuing a TCP query. By repeatedly triggering this condition, an attacker can deny all TCP service to the affected NSD instance while UDP resolution paths remain unaffected. The flaw is rooted in an integer underflow condition [CWE-191] in the TCP write path.

Critical Impact
Unauthenticated remote attackers can continuously crash NSD serve child processes, resulting in sustained denial of TCP-based DNS service to the authoritative name server.

Affected Products

NLnet Labs NSD (Name Server Daemon)
Deployments exposing TCP port 53 to untrusted networks
Authoritative DNS infrastructure relying on NSD serve children for TCP responses

Discovery Timeline

2026-08-26 - CVE CVE-2026-18916 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18916

Vulnerability Analysis

The vulnerability affects how NSD serve child processes handle TCP write operations to slow or unresponsive clients. When a remote client issues a TCP DNS query and then throttles its TCP receive window, the serve child fails to correctly account for partially transmitted bytes. This mismanagement triggers an integer underflow [CWE-191] in size or offset arithmetic, causing the serve child to crash.

NSD forks a pool of serve child processes to handle queries. When one child crashes, remaining children continue to service traffic, but sustained abuse rapidly exhausts the pool. Because the attack requires only a single TCP query per crash cycle, an unauthenticated remote attacker can loop the pattern to keep TCP service unavailable. UDP query handling is not affected, but resolvers that fall back to TCP for large responses, DNSSEC, or truncated answers will fail.

Root Cause

The root cause is improper handling of TCP send-side flow control. When the client advertises a zero or shrinking receive window, the NSD serve child's write accounting logic underflows an unsigned length field. The resulting large value drives out-of-bounds behavior or an assertion failure that terminates the process. Full technical details are provided in the NLnet Labs CVE-2026-18916 advisory.

Attack Vector

The attack requires only network reachability to the NSD TCP listener on port 53. No authentication or user interaction is needed. An attacker opens a TCP connection, sends a valid DNS query, then advertises a zero-window or slowly shrinking receive window on the response. The serve child crashes during the write path. Repeating this pattern across concurrent connections denies TCP DNS service to all legitimate clients.

Detection Methods for CVE-2026-18916

Indicators of Compromise

Repeated unexpected termination of NSD serve child processes in system logs or the NSD process supervisor.
TCP connections from remote clients that complete a DNS query but stall the response with a zero or shrinking TCP window.
Sudden increase in TCP RST or connection reset events on port 53 correlated with serve child restarts.
Client complaints about failed AXFR, IXFR, or truncated-response retries over TCP while UDP resolution succeeds.

Detection Strategies

Monitor NSD process supervisor and syslog output for serve child exit or restart messages and alert on frequency spikes.
Inspect TCP metrics at the network layer for connections advertising window size 0 following a completed DNS query.
Correlate authoritative DNS TCP query volume with serve child crash rate to surface abuse patterns.

Monitoring Recommendations

Enable verbose NSD logging and forward events to a centralized log platform for anomaly analysis.
Track TCP session duration distributions on port 53 to identify long-lived, zero-window flows.
Alert when NSD serve child crash count exceeds a defined threshold within a rolling time window.

How to Mitigate CVE-2026-18916

Immediate Actions Required

Upgrade NSD to the fixed version identified in the NLnet Labs CVE-2026-18916 advisory as soon as it is available.
Restrict inbound TCP port 53 to known resolvers and zone transfer peers where the deployment permits.
Rate-limit new TCP connections per source IP at the network edge or host firewall to slow abuse.
Ensure NSD is run under a process supervisor that automatically restarts crashed serve children.

Patch Information

NLnet Labs has published details for CVE-2026-18916 in the official advisory. Administrators should consult the advisory for the fixed release version and apply the upgrade through their distribution package manager or by rebuilding from source. Verify the running version after upgrade using nsd -v and restart the service to ensure all serve children run patched code.

Workarounds

Enforce short TCP write timeouts on the host or via a front-end load balancer to terminate stalled response streams.
Deploy a TCP-aware DNS proxy or firewall rule that drops connections advertising zero receive windows after a query has been sent.
Increase the number of NSD serve children to raise the cost of sustained denial while a patch is applied.
Limit exposure of the authoritative server to the public internet where operationally feasible, allowing only trusted resolver networks over TCP.

bash

# Configuration example: restrict TCP/53 to trusted resolvers with iptables
iptables -A INPUT -p tcp --dport 53 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -m conntrack --ctstate NEW -m limit --limit 20/second --limit-burst 40 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j DROP