NSD -- multiple vulnerabilities

NLnet Labs reports:

• CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics.
• CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window (down to 1). Reported by akoul (Akhil Koul)
• CVE-2026-19401: Any remote client can denial UDP service by sending a specifically crafted query with multiple DNS Cookie options. Reported by Qifan Zhang from Palo Alto Networks and afldl.
• CVE-2026-19538: Anyone with access to the proxy protocol port over TCP or TLS can bypass BLOCKED access control items. Reported by Qifan Zhang from Palo Alto Networks.

[source]