CVE-2026-18916

Отчет

This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger child worker process crashes over the network, leading to a persistent denial of service for all incoming TCP DNS queries without requiring privileges or user interaction. Within the Red Hat ecosystem, the NSD package is not part of core Red Hat Enterprise Linux releases and is maintained only through community repositories such as EPEL and Fedora. Because this flaw specifically targets TCP traffic handling, standard UDP DNS query resolution remains functional unless all daemon worker processes are exhausted.

Меры по смягчению последствий

To mitigate this issue, restrict network access to the NSD service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the NSD port (typically 53/tcp) or by configuring NSD to listen only on specific, trusted network interfaces or localhost if remote access is not required. For example, using firewalld on Red Hat Enterprise Linux:

Replace <TRUSTED_IP_RANGE> with the IP address or range of your trusted clients. If NSD is only intended for local use, consider binding it to the localhost interface. Note that applying firewall rules or reconfiguring network interfaces may require a restart or reload of the NSD service and could impact DNS resolution for unauthorized clients.