CVE-2026-19401: NSD DNS Server DoS Vulnerability

CVE-2026-19401 Overview

CVE-2026-19401 is a denial-of-service vulnerability in NLnet Labs NSD (Name Server Daemon) debugging or non-release builds. A remote client can crash an NSD serve child process by sending a specially crafted DNS message containing a tuned number of DNS Cookie options. The advisory specifies 17 DNS Cookie options when the UDP payload size is 512 bytes. Repeatedly triggering the crash allows an unauthenticated attacker to hamper or fully deny DNS service on affected instances. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Continuous exploitation crashes NSD serve child processes and can result in complete denial of DNS service for clients within reach of the attacker.

Affected Products

NLnet Labs NSD (debugging / non-release build types)
Deployments running NSD with UDP payload size of 512 and DNS Cookie processing enabled
Version details are published in the vendor advisory referenced below

Discovery Timeline

2026-08-26 - CVE-2026-19401 published to NVD
2026-08-26 - Last updated in NVD database
Vendor advisory: NLnet Labs CVE-2026-19401 Document

Technical Details for CVE-2026-19401

Vulnerability Analysis

NSD is an authoritative DNS server developed by NLnet Labs. The vulnerability affects how NSD serve child processes handle DNS messages that carry multiple DNS Cookie options in the EDNS OPT record. When a specific number of DNS Cookie options is packed into a message aligned to the UDP payload size, the serve child process crashes. The advisory identifies 17 DNS Cookie options at a 512-byte UDP payload size as the crashing condition.

The issue is present in debugging or non-release build types of NSD. Because DNS queries traverse UDP on port 53 and require no authentication, any remote client that can reach the server can send the crafted message. Continuous transmission of these messages crashes serve children faster than they can be respawned, resulting in denial of service to legitimate DNS clients.

Root Cause

The root cause is uncontrolled resource consumption or an assertion failure triggered when parsing an unexpectedly large number of DNS Cookie options in a single message. Debug builds enable additional consistency checks and assertions that terminate the process on the anomalous input. Refer to the vendor advisory for the exact code paths involved.

Attack Vector

The attack vector is network-based over UDP. An unauthenticated remote attacker crafts a DNS query with 17 DNS Cookie options packed into the EDNS OPT record while the UDP payload size negotiated for the transaction is 512 bytes. Each successful message crashes an NSD serve child. Repeated delivery from an attacker positioned close to the server sustains the outage.

No verified public exploit code is currently indexed. See the NLnet Labs CVE-2026-19401 Document for reproduction details.

Detection Methods for CVE-2026-19401

Indicators of Compromise

Repeated NSD serve child process crashes or restarts in syslog, journalctl, or NSD logs
Inbound UDP/53 queries containing an unusually high count of DNS Cookie options in the EDNS OPT record
Abnormal spikes in short-lived DNS queries followed by service unavailability from a single source or subnet

Detection Strategies

Inspect DNS traffic with tcpdump or tshark for OPT records containing more than one DNS Cookie option (option code 10)
Deploy IDS rules on Suricata or Zac that flag DNS messages with abnormal OPT option counts
Correlate NSD process termination events with concurrent inbound DNS query patterns

Monitoring Recommendations

Enable and centralize NSD stderr, syslog, and crash logs for real-time alerting
Track serve child respawn rates as a service-health metric and alert on sustained increases
Monitor upstream network telemetry for repeated crafted DNS queries from the same source addresses

How to Mitigate CVE-2026-19401

Immediate Actions Required

Confirm whether production NSD instances were built with debugging or non-release build flags and replace them with release builds
Apply the patched NSD version referenced in the NLnet Labs advisory
Restrict inbound UDP/53 access to trusted networks where operationally feasible
Enable rate limiting at the network edge for repeated malformed DNS queries

Patch Information

NLnet Labs publishes the fixed version and patch details in the CVE-2026-19401 advisory. Administrators should upgrade NSD to the fixed release identified in the vendor document and rebuild any custom packages from the patched source tree. Confirm the deployed binary is not a debugging build after upgrade.

Workarounds

Rebuild NSD from source without debugging assertions when patching is not immediately possible
Filter or drop DNS queries containing multiple DNS Cookie options at an upstream firewall or DNS-aware proxy
Deploy a redundant authoritative DNS layer using a different implementation to preserve availability during targeted attacks

bash

# Verify NSD build type and version after upgrade
nsd -v

# Restrict inbound DNS to trusted resolvers (example iptables rule)
iptables -A INPUT -p udp --dport 53 -m set ! --match-set trusted_resolvers src -j DROP