CVE-2026-18664: Wrong interpretation of ACL ranges
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NSDto a version that resolves this vulnerability.Fixed in 4.15.1
Event History
Frequently Asked Questions
Which deployments are exposed to unintended access decisions?
NSD deployments running on little-endian systems that use IPv4 or IPv6 address ranges in access-control rules are affected. Deployments that do not use range-form ACL entries are not identified as affected by the provided information.
What access outcome can occur because of the comparison error?
Addresses intended to be allowed can be denied, while addresses intended to be denied can be allowed. This affects both IPv4 ranges and IPv6 ranges.