Which versions of NSD are affected by CVE-2026-12246?

NSD 4.14.0, an authoritative DNS server used by organizations to host DNS zones, contains a stack buffer overflow affecting zone data serialization that could allow authenticated attackers with low…. A patch is available.

How to fix or mitigate CVE-2026-12246?

24 hours: Identify all systems running NSD 4.14.0 and audit zone data update sources (automated scripts, APIs, manual imports). 7 days: Restrict zone data modification access to administrator accounts only, implement network segmentation to limit who can perform zone transfers, and enable audit logging for zone changes. 30 days: Contact NLnet Labs for patch timeline and plan upgrade path; evaluate alternative DNS servers if patching timeline is extended beyond 60 days.

NSD CVE-2026-12246

Q: What is the CVSS score of CVE-2026-12246?

CVE-2026-12246 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39184 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-25 NLnet Labs

GHSA-xgm5-85mh-3559

Buffer Overflow Red Hat Suse Nsd Nlnet Labs

7.2

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Attacker must control zone content so PR:L; network-reachable serialization path AV:N/AC:L; stack overwrite corrupts/crashes giving I:H and A:H with no disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 08:01 EUVD

Analysis Generated

Jun 25, 2026 - 07:00 vuln.today

DescriptionCVE.org

NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

AnalysisAI

Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to overwrite up to 111 attacker-controlled bytes on the stack when a specially crafted APL resource record - carrying an adflength larger than the address family permits - is serialized as the zone is written to disk. Per the CVSS 4.0 vector (PR:L), exploitation requires low privileges and yields high integrity and availability impact, consistent with memory corruption leading to crash or potential code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

NSD is an authoritative-only DNS name server developed by NLnet Labs, used to serve DNS zones for domains including high-traffic and root/TLD infrastructure. The flaw lives in NSD's handling of the APL (Address Prefix List, RFC 3123) resource record type, which encodes address-family-scoped prefixes with an 'afdlength' field describing how many address bytes follow. The regression was introduced in version 4.14.0 (cpe:2.3:a:nlnet_labs:nsd), where the code fails to validate that afdlength does not exceed the maximum length allowed for the declared address family (4 bytes for IPv4, 16 for IPv6). When the zone is committed to disk, copying the oversized address data into a fixed stack buffer overflows it - a textbook CWE-120 classic buffer overflow (copy without size check) - corrupting up to 111 bytes of attacker-influenced stack memory.

RemediationAI

Upgrade NSD to the fixed release published by NLnet Labs as referenced in the advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt; the input data does not contain a confirmed exact fix version, so released patched version is not independently confirmed and the precise target version should be read from that advisory before deploying. As compensating controls until patched, restrict who and what can supply zone content to NSD: tightly limit and authenticate zone-transfer sources (allow-notify/provide-xfr with TSIG and explicit ACLs), validate or sanitize zone data in your provisioning pipeline to reject APL records whose afdlength exceeds 4 bytes (IPv4) or 16 bytes (IPv6), and avoid serving zones from untrusted or externally-writable sources. If APL records are not used in your zones, dropping or filtering them at the provisioning layer removes the trigger; the trade-off is added pipeline validation and the rare case where legitimate APL records are needed.