CVE-2026-19401: CWE-617 Reachable Assertion in NLnet Labs NSD

The vulnerability identified as CVE-2026-19401 affects NLnet Labs NSD version 4.3.7. It involves a reachable assertion triggered by a remote client sending a DNS message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512) to a server child process in debugging or non-release builds. This causes the server child to crash. Continuous exploitation can severely disrupt or deny DNS service, especially if the attacker is positioned close to the target. The CVSS 4.0 score is 8.2, indicating high severity. There is no vendor advisory or patch information available at this time.

An unauthenticated remote attacker can cause a denial of service by repeatedly crashing NSD server child processes in debugging or non-release builds. This can severely hamper DNS service availability or cause denial of service if the attacker is sufficiently close to the target network. There is no indication of code execution or data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running NSD in debugging or non-release build configurations in production environments. Monitor for unusual DNS traffic patterns involving DNS Cookie options as a precaution.