The CVE number for this vulnerability is CVE-2026-19401

= Summary
Any remote client can denial UDP service by sending a specifically crafted
query with multiple DNS Cookie options.


== Affected products
NSD from and including version 4.3.7 up to and including version 4.15.0


== Description
Any remote client can crash a (debugging/non-release build type) NSD serve
child by sending it a special crafted message with a specially tuned number of
DNS Cookie options (17 when UDP payload size is 512). By continuously crashing
the serve childs, the remote client can severely hamper or, when positioned
sufficiently close, deny all DNS service.

== Mitigation

=== Downloading patched version
NSD 4.15.1 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.1.tar.gz

=== Applying the patch manually
For NSD 4.15.0 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-19401.diff

Apply the patch on the nsd source directory with:
    patch -p1 < patch_CVE-2026-19401.diff
then run 'make install' to install nsd.

The patch is tested to work on nsd 4.15.0.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networksa and afldl
<zhangph@yandex.com> for discovering and responsibly disclosing the
vulnerability.