The CVE number for this vulnerability is CVE-2026-18916

= Summary
Any remote client can denial TCP service by throttling the TCP receive window (down to 1).


== Affected products
NSD from and including version 3.2.11 up to and including version 4.15.0


== Description
Any remote client can crash a NSD serve child, by throttling the TCP receive
window after a TCP query. By continuously crashing the serve childs, the remote
client can denial all TCP service to this NSD instance.

== Mitigation

=== Downloading patched version
NSD 4.15.1 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.1.tar.gz

=== Applying the patch manually
For NSD 4.15.0 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-18916.diff

Apply the patch on the nsd source directory with:
    patch -p1 < patch_CVE-2026-18916.diff
then run 'make install' to install nsd.

The patch is tested to work on nsd 4.15.0.


== Acknowledgments
We would like to thank Akhil Koul (https://github.com/akoul) for discovering
and responsibly disclosing the vulnerability.