CVE-2026-19401: Remote UDP DoS by sending multiple DNS Cookie options

Published Aug 26, 2026

Updated

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.

Affected Software

1 affected component

DNSD server

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.15.1

Event History

Aug 26, 2026

CVE Published

via MITRE·08:44 AM

Data Sourced

via MITRE·08:44 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

The issue affects NSD serve child processes running a debugging or non-release build type. A remote client can target the service over UDP.

What does an attacker need to do to trigger the crash?

The attacker needs to send a specially crafted DNS message containing a tuned number of DNS Cookie options. The described case uses 17 Cookie options when the UDP payload size is 512 bytes.

How severe can the operational impact be?

Repeatedly crashing serve child processes can severely hamper DNS service. An attacker positioned sufficiently close can deny all DNS service.