Back Linuxsecurity

Fedora 43 nsd High Risk Access Control Bypass and DoS Patches 2026

Linuxsecurity •LinuxSecurity Advisories • September 8, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

NSD is a complete implementation of an authoritative DNS name server.

For further information what NSD is and what NSD is not please

consult the REQUIREMENTS document which is a part of this distribution.

BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networks for the report Thanks to Claude and Ada Logics for the report Fix for CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window (down to 1). Thanks to Akhil Koul ( for the report Fix for CVE-2026-19401: Any remote client can denial UDP service by sending a specifically crafted query with multiple DNS Cookie options. Thanks to Qifan Zhang, Palo Alto Networks for the report Thanks to afldl [email protected] for the report Fix for CVE-2026-19538: Anyone with access to the proxy protocol port over TCP or TLS can bypass BLOCKED access control items. Thanks to Qifan Zhang, Palo Alto Networks ...

* Fri Aug 28 2026 Fabio Alessandro Locati - 4.15.1-1 - Update to 4.15.1. Fixes rhbz#2524370

[ 1 ] Bug #2524349 - CVE-2026-18664 nsd: NSD: Access control bypass due to incorrect IP range comparison [epel-all] [ 2 ] Bug #2524350 - CVE-2026-18664 nsd: NSD: Access control bypass due to incorrect IP range comparison [fedora-all] [ 3 ] Bug #2524353 - CVE-2026-18916 nsd: NSD: Denial of Service due to TCP receive window throttling [epel-all] [ 4 ] Bug #2524354 - CVE-2026-18916 nsd: NSD: Denial of Service due to TCP receive window throttling [fedora-all] [ 5 ] Bug #2524355 - CVE-2026-19401 nsd: NSD: Remote denial of service via crafted DNS Cookie options [epel-all] [ 6 ] Bug #2524356 - CVE-2026-19401 nsd: NSD: Remote denial of service via crafted DNS Cookie options ...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3ff003d397' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Fedora NSD: Access Control Bypass and DoS Risks On September 8, 2026, Fedora released patches for multiple critical vulnerabilities in NSD, an authoritative DNS name server. The vulnerabilities include CVE-2026-18664, which allows IP range access control bypass, and CVE-2026-18916, enabling denial of service via TCP window throttling. Additionally, CVE-2026-19401 permits remote denial of service through crafted DNS Cookie options. CVE-2026-19538 allows access control bypass for users with proxy protocol port access. All vulnerabilities were published on August 26, 2026, and affect Fedora 43 and 44 versions. Users are urged to apply the patches immediately to mitigate risks. The updates can be installed using the 'dnf' update program. 2 sources 58

Extracted Entities

Fedora 43 nsd High Risk Access Control Bypass and DoS Patches 2026

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)

MITRE ATT&CK (1)

Platforms (1)