High severity · published Aug 26, 2026
CVE-2026-19401
Remote UDP DoS by sending multiple DNS Cookie options
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
NSD · NLnet Labs
4.3.7 before 4.15.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19401
Vendor Advisory
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19401.txt
More from NSD
9.1
CVE-2026-18664
Wrong interpretation of ACL ranges
8.8
CVE-2026-12244
Heap overflow and crash with crafted SVCB RR
8.7
CVE-2026-101341
Stack overwrite from specially formatted TXT-DATA RDATA field
8.7
CVE-2026-101339
Stack overwrite from a specially crafted and formatted HIP RR
8.7
CVE-2026-101338
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR