---
id: CVE-2026-18916
title: >-
  Any remote client can crash a NSD serve child, by throttling the TCP receive
  window after a TCP query
summary: >-
  Any remote client can crash a NSD serve child, by throttling the TCP receive
  window after a TCP query. By continuously crashing the serve childs, the
  remote client can denial all TCP service to this NSD instance.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-191
vendor: nlnetlabs
product: nsd
affected:
  - 'nsd >= 3.2.11, < 4.15.1'
patched:
  - nsd 4.15.1
published: '2026-08-26'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:00:51.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18916'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18916.txt'
    label: sep@nlnetlabs.nl
tags:
  - nvd
epss: 0.00281
epssPercentile: 0.18311
ingestedAt: '2026-09-08T20:10:03.158Z'
---

## Overview

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.

## Affected

- `nsd >= 3.2.11, < 4.15.1`

## Remediation

Upgrade past the affected range:

- `nsd 4.15.1`