CVE-2026-18916

Description

A flaw was found in NSD. A remote attacker can exploit this vulnerability by continuously throttling the TCP receive window after a TCP query, causing an NSD serve child to crash. This repeated crashing can lead to a complete denial of TCP service for the affected NSD instance.

Statement

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Mitigation

To mitigate this issue, restrict network access to the NSD service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the NSD port (typically 53/tcp) or by configuring NSD to listen only on specific, trusted network interfaces or localhost if remote access is not required.

For example, using `firewalld` on Red Hat Enterprise Linux:

bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_RANGE>" port port="53" protocol="tcp" accept'
firewall-cmd --reload
Replace `<TRUSTED_IP_RANGE>` with the IP address or range of your trusted clients. If NSD is only intended for local use, consider binding it to the localhost interface.

Note that applying firewall rules or reconfiguring network interfaces may require a restart or reload of the NSD service and could impact DNS resolution for unauthorized clients.

Understanding the Weakness (CWE)

CWE-770

Availability

Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.