Which versions of NSD are affected by CVE-2026-12244?

CVE-2026-12244 affects NLnet Labs NSD, a DNS secondary server used to maintain redundant domain name resolution, and could enable remote code execution if exploited.. A patch is available.

How to fix or mitigate CVE-2026-12244?

24 hours: Identify all NSD instances configured as secondary servers; verify zone transfer source ACLs restrict access to known, trusted primaries only; search logs for unusual zone transfer requests (AXFR). 7 days: Implement TSIG authentication for all zone transfers via DNS configuration; enforce firewall rules restricting TCP port 53 to authorized primary servers only; enable verbose AXFR logging for monitoring. 30 days: Monitor vendor advisories at https://nlnetlabs.nl for patch release; prepare NSD upgrade procedures with documented rollback plans; establish contingency plans with alternative DNS secondaries if patch is delayed.

NSD CVE-2026-12244

Q: What is the CVSS score of CVE-2026-12244?

CVE-2026-12244 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39182 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-25 NLnet Labs

GHSA-p22w-wq6p-g85g

Denial Of Service Integer Overflow Red Hat Suse Nsd Nlnet Labs

8.7

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered via AXFR (AV:N), low complexity (AC:L), but requires the trusted primary role so PR:L; controlled heap write yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 08:01 EUVD

Analysis Generated

Jun 25, 2026 - 07:00 vuln.today

DescriptionCVE.org

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

AnalysisAI

Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave) NSD instance by sending an AXFR transfer containing a crafted SVCB resource record. An rdata size of 65512 causes a uint16_t length variable used for RR allocation to wrap (total size exceeds 65535), producing an undersized buffer and a controlled out-of-bounds write of up to 65509 bytes - an RCE-class primitive (CWE-190 integer overflow leading to heap overflow). No public exploit identified at time of analysis, but the controlled write and remote network vector (CVSS 4.0 base 8.7) make this a high-priority patch for any operator running NSD as a secondary.

Technical ContextAI

NSD (Name Server Daemon) is an authoritative-only DNS nameserver from NLnet Labs, commonly deployed as a secondary that pulls zones from a primary via AXFR/IXFR zone transfers. The flaw is in NSD's parsing/allocation of a received SVCB resource record (RFC 9460, used for HTTPS/service binding records) during AXFR processing. Per CWE-190, the code computes the buffer size for the incoming RR using a 16-bit (uint16_t) variable; an rdata length of 65512 pushes the computed total (rdata plus RR overhead) past 65535, wrapping the 16-bit value to a small number. The subsequent allocation is therefore far smaller than the data copied into it, yielding a heap buffer overflow whose contents and length (up to 65509 bytes) are attacker-controlled, placing this in the remote-code-execution risk class rather than mere denial of service. The CPE cpe:2.3:a:nlnet_labs:nsd:*:*:*:*:*:*:*:* indicates all NSD versions prior to the fix should be treated as potentially affected pending exact version confirmation.

RemediationAI

Upgrade NSD to the fixed release identified in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt; the exact patched version number is not included in the provided data and must be taken from that advisory - patch available per vendor advisory, version to be confirmed from the source. As compensating controls until patched: enforce TSIG authentication on all zone transfers so that only the legitimate, key-holding primary can send AXFR data (this blocks spoofed/on-path primaries but does not protect against a genuinely compromised primary); strictly limit the allow-notify/request-xfr and provide-xfr ACLs to known primary IP addresses and bind transfer endpoints to trusted management networks (trade-off: must be kept in sync as topology changes); and where feasible, place secondaries behind network controls that restrict inbound TCP/53 to the known primary only. None of these controls neutralize a malicious or fully compromised primary, so patching is the only complete fix.