CVE-2026-18664
Last modified
CVE-2026-18664 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nlnetlabs | Nsd | >= 3.0.0, < 4.15.1 |
References
- https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18664.txtVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-18664?
How severe is CVE-2026-18664?
How do I fix CVE-2026-18664?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18655Improper restriction of intended endpoints in the RabbitMQ b…7.1
- CVE-2026-18656An uncontrolled search path element in Kiro IDE before versi…7.8
- CVE-2026-18657An uncontrolled search path element in Kiro CLI before versi…7.8
- CVE-2026-18658IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0,…9.8
- CVE-2026-1866The Name Directory plugin for WordPress is vulnerable to Sto…7.2
- CVE-2026-18663A flaw was found in 389-ds-base. The get_ldapmessage_control…5.9
- CVE-2026-18666The Library Management System WordPress plugin before 3.6.7 …4.3
- CVE-2026-18667A vulnerability in Tenable Sensor Proxy allows a remote atta…9.6
- CVE-2026-18669IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege es…8.8
- CVE-2026-1867The Guest posting / Frontend Posting / Front Editor WordPre…5.9
- CVE-2026-18670IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a …9.1
- CVE-2026-18671IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated at…5.3
Are you affected by CVE-2026-18664?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST