CVE-2026-18916: Remote TCP DoS by throttling the TCP receive window
Published Aug 26, 2026
·Updated
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Affected Software
1 affected component
NSD (Name Server Daemon)
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.15.1
Event History
Aug 26, 2026
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need authentication or prior access to exploit this issue?
No prior access is indicated. Any remote client that can send a TCP query to the NSD instance can trigger the condition by throttling the TCP receive window.
2
What service impact can repeated exploitation cause?
The attack can crash NSD serve child processes. By continuously causing these crashes, an attacker can deny TCP service to the affected NSD instance.