Access Control Vulnerability in NSD by NLnet Labs

CVE-2026-18664

What is CVE-2026-18664?

A vulnerability exists in NLnet Labs' NSD related to access control when handling IP address ranges. The flaw arises from improper comparison of IP addresses in little endian systems. As a result, IP addresses that should have been allowed may be incorrectly denied access, while those that are intended to be blocked could gain unauthorized access. This misalignment occurs due to the way IPv4 addresses are compared as unsigned 32-bit numbers, considering the host's endianness, despite the values being in network byte order (big-endian). For IPv6 addresses, the comparison similarly relies on host endianness, creating additional inconsistencies. Users of NSD should review and address this vulnerability to enhance the security of their systems.

References