https://seclists.org/oss-sec/2026/q3/605: NSD 4.15.1 security lease

Q: Which issues can be exploited remotely without an authenticated NSD account?

The TCP receive-window issue is described as a remote TCP denial of service, and the multiple DNS Cookie option issue is described as a remote UDP denial of service. The provided information does not state whether authentication or any additional access conditions are required.

Q: What traffic or configuration areas should be prioritized when assessing exposure?

Prioritize NSD TCP and TLS service paths, UDP DNS handling, ACL range definitions, and any listener using the proxy protocol. The proxy-protocol issue specifically concerns bypassing BLOCKED ACL items over TCP or TLS.

Q: Is there a known version on which the supplied patches have been tested?

The patches are stated to have been tested to apply and work on NSD 4.15.0. No fixed release version is identified in the provided information.

Published Aug 28, 2026

Updated

Affected Software

1 affected component

NSD NSD>4.15.0<=4.15.1

Frequently Asked Questions

Which issues can be exploited remotely without an authenticated NSD account?

The TCP receive-window issue is described as a remote TCP denial of service, and the multiple DNS Cookie option issue is described as a remote UDP denial of service. The provided information does not state whether authentication or any additional access conditions are required.

What traffic or configuration areas should be prioritized when assessing exposure?

Prioritize NSD TCP and TLS service paths, UDP DNS handling, ACL range definitions, and any listener using the proxy protocol. The proxy-protocol issue specifically concerns bypassing BLOCKED ACL items over TCP or TLS.

Is there a known version on which the supplied patches have been tested?

The patches are stated to have been tested to apply and work on NSD 4.15.0. No fixed release version is identified in the provided information.