Linuxsecurity Critical Vulnerabilities in Fedora NSD: Access Control Bypass and DoS Risks
Article Content
- •Multiple critical vulnerabilities in Fedora NSD require immediate patching.
- •CVE-2026-18664 allows access control bypass; CVE-2026-18916 enables DoS attacks.
- •Patches are available for Fedora 43 and 44; users must update to secure their systems.
On September 8, 2026, Fedora released patches for multiple critical vulnerabilities in NSD, an authoritative DNS name server. The vulnerabilities include CVE-2026-18664, which allows IP range access control bypass, and CVE-2026-18916, enabling denial of service via TCP window throttling. Additionally, CVE-2026-19401 permits remote denial of service through crafted DNS Cookie options. CVE-2026-19538 allows access control bypass for users with proxy protocol port access. All vulnerabilities were published on August 26, 2026, and affect Fedora 43 and 44 versions. Users are urged to apply the patches immediately to mitigate risks. The updates can be installed using the 'dnf' update program.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-18664 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Korean-speaking Hackers Target PHP Vulnerabilities in Global Campaign A cybersecurity report from Cyfirma reveals that attackers, possibly linked to North Korea's Lazarus group, are preparing to exploit critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated remote code execution, posing a significant threat to government…