NSD incorrectly compares IPv4 and IPv6 addresses against ACL ranges on little endian systems by using the host’s byte order instead of network byte order. This logic fault causes IP addresses that should be allowed to be denied and IP addresses that should be denied to be allowed, creating a risk of unauthorized access or service disruption. The flaw is categorized as an access‑control weakness (CWE‑284) and a logic error (CWE‑697).

NLnet Labs NSD versions prior to 4.15.1 are vulnerable. The official fix was released with NSD 4.15.1 and all later releases.

The CVSS score of 8.2 demonstrates high severity, but the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Because the flaw operates on IP comparison during normal DNS request handling, it is likely exploitable remotely by passing traffic that falls within or outside the intended ACL ranges. Once the altered comparison is triggered, an attacker could evade ACL restrictions or block legitimate clients, thereby compromising confidentiality, integrity, or availability of the DNS service.