The CVE number for this vulnerability is CVE-2026-18664

= Summary
IP range access control restrictions are bypassed for some unintended IP
addresses.


== Affected products
NSD from and including version 3.0.0 up to and including version 4.15.0


== Description
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25),
because NSD wrongly compares the IP address with the range on little endian
systems, IPs that were meant to be allowed may be denied, and, IPs that were
meant to be denied access could be allowed.

An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers
directly with the endianness of the host, but the values to compare are in
network byte order (big-endian).  With IPv6 addresses the comparison is done in
4 times a unsigned 32 bit number comparison, again with the endianness of the
host where all values are actually in network bye order.


== Mitigation

=== Downloading patched version
NSD 4.15.1 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.1.tar.gz

=== Applying the patch manually
For NSD 4.15.0 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-18664.diff

Apply the patch on the nsd source directory with:
    patch -p1 < patch_CVE-2026-18664.diff
then run 'make install' to install nsd.

The patch is tested to work on nsd 4.15.0.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, as well as Claude
and Ada Logics, for discovering and responsibly disclosing the vulnerability.