Source status: NLnet Labs' advisory directly credits Qifan Zhang, Claude, and Ada Logics for discovery and reporting. The CNA record scores the flaw CVSS 4.0 8.2 high; NSD 4.15.1 contains the fix.
Summary
NSD compared IP-range ACL values in the wrong byte order on little-endian systems. A range intended to authorize one set of addresses could therefore admit addresses outside that set. Versions 3.0.0 through 4.15.0 are affected; 4.15.1 fixes the comparison.
The advisory’s reporter line names Claude but no specific Claude model, so the entry belongs to the broad Claude / Anthropic Research profile rather than the Mythos profile.
References
Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.