Which versions of NSD are affected by CVE-2026-12245?

NLnet Labs NSD authoritative DNS servers version 4.13.0 and later are vulnerable to unauthenticated remote denial-of-service attacks that crash the DNS process via a heap use-after-free in TLS error…. A patch is available.

How to fix or mitigate CVE-2026-12245?

Within 24 hours: Audit inventory for NSD 4.13.0+ instances in production; confirm DNS failover capacity and secondary nameserver readiness. Within 7 days: Deploy compensating controls including per-source DoT rate limiting, connection timeouts (≤30 seconds idle), and firewall rules blocking rapid reconnection patterns; disable DoT protocol on exposed instances if not business-critical. Within 30 days: Monitor NLnet Labs GitHub and security mailing list for patched versions; prepare upgrade procedures and test in non-production to deploy within 24 hours of patch release.

NSD CVE-2026-12245

Q: What is the CVSS score of CVE-2026-12245?

CVE-2026-12245 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39183 HIGH

Use After Free (CWE-416)

2026-06-25 NLnet Labs

GHSA-rcp9-2p4r-m2hm

Memory Corruption Denial Of Service Use After Free Nsd Red Hat Suse

8.7

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated trigger with no user interaction; impact is a server crash, so availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 08:01 EUVD

Analysis Generated

Jun 25, 2026 - 07:00 vuln.today

DescriptionCVE.org

NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.

AnalysisAI

Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenticated attacker to crash the server process by exploiting a heap use-after-free in the TLS error-logging path. By sending a DNS query over a DNS-over-TLS (DoT) connection and closing the socket before reading the response, an attacker triggers the freed-memory access trivially; no public exploit identified at time of analysis, and the issue is not in CISA KEV. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity exposure.

Technical ContextAI

NSD (Name Server Daemon) is a high-performance authoritative-only DNS server developed by NLnet Labs, used by several root and TLD operators. The flaw lives in NSD's DNS-over-TLS (DoT, RFC 7858) handling: when an error occurs on a TLS connection and NSD attempts to log it, it accesses a connection/buffer object that has already been freed, corresponding to CWE-416 (Use After Free). The trigger is an abrupt client-side connection teardown after a query is sent but before the response is read, which drives NSD into the error-logging code path against a dangling pointer, leading to memory corruption and a process crash.

RemediationAI

Upgrade NSD to the fixed release identified in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt; an exact patched version was not provided in the input data and must be taken from that advisory (do not assume a version number). As an immediate compensating control where patching is not yet possible, disable DNS-over-TLS service in NSD (remove the tls-port / DoT interface configuration), which eliminates the vulnerable code path entirely - the trade-off is loss of encrypted DNS transport, so clients must fall back to UDP/TCP. If DoT must remain available, restrict access to the DoT listener (typically TCP port 853) via firewall rules to known resolver clients only, accepting that this provides only partial protection if any permitted client can reach the listener. Monitor for repeated NSD process crashes/restarts as an indicator of attempted exploitation.