EUVD-2026-39185
GHSA-27xx-c7vg-hjjj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify NSD with XFR-over-TLS client-cert config
-
DeliveryConnect to regular tls-port or TCP port without client cert
-
ExploitSatisfy provide-xfr match conditions
-
ExecutionSend AXFR/IXFR request
-
ImpactReceive full zone data (auth bypassed)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target NSD to have a provide-xfr rule configured with a tls-auth-name (i.e., XFR-over-TLS client-certificate authentication is in use) - this is not NSD's default and is the core prerequisite. The attacker must also satisfy the rule's other conditions (the matching source/address and any associated TSIG key requirement) and must connect over the regular tls-port (not the tls-auth-port) or over TCP on the regular port; on those paths NSD omits the client-certificate check. Limiting factors: the bypass only exists for operators who enabled tls-auth-name, exploitation is constrained by the provide-xfr ACL match conditions (CVSS AC:H), and impact is limited to disclosure of zone data (VC:H, VI:N/VA:N) with no modification or denial. |
| Impact | This is a credible, prioritizable confidentiality issue rather than a high-score-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H) correctly reflects network reachability, no privileges required (the missing auth is the bug), and high confidentiality impact with no integrity/availability effect - consistent with unauthorized zone disclosure. AC:H reflects that exploitation depends on a specific configuration (a provide-xfr rule using tls-auth-name) and on the attacker satisfying the rule's other conditions (e.g., source address and any TSIG key). No EPSS score, POC, or KEV entry is provided, so likelihood signals are absent: treat as no public exploit identified at time of analysis and not known to be actively exploited. The practical risk is highest for operators who deliberately deployed XFR-over-TLS client-cert auth expecting it to be enforced - for them the control is silently bypassable. There is no signal conflict in the supplied data, though the exact fixed version is not included and should be confirmed from the vendor advisory. |
| Exploit ScenarioDerived | An attacker who can reach an NSD server's regular tls-port or plain TCP DNS port - and who meets the provide-xfr rule's other conditions such as a permitted source address - issues an AXFR request without any client certificate and receives the full zone contents that were supposed to be protected by mutual-TLS authentication. No public POC is referenced; AC:H reflects the dependence on a specific tls-auth-name configuration and on satisfying the rule's remaining match conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.
RemediationAI
Upgrade NSD to the patched release referenced in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt (patch available per vendor advisory; the exact fixed version is not included in the provided data and must be taken from that advisory). As compensating controls until patched: restrict the regular tls-port and TCP DNS port so that only the dedicated tls-auth-port is reachable from secondaries that should use client-certificate auth (e.g., firewall the standard 53/TCP and non-auth TLS listener from transfer peers), accepting that legitimate non-cert transfers on those ports will also be blocked; tighten provide-xfr rules with strict source-address ACLs and TSIG keys so a bypassing request cannot satisfy the remaining match conditions, accepting the operational overhead of TSIG key management; and monitor query/transfer logs for AXFR/IXFR served over non-auth ports. Do not rely on tls-auth-name alone for confidentiality until the upgrade is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NSD (Name Server Daemon) is an authoritative-only DNS server. Zone transfers (AXFR/IXFR) replicate zone data from a primary to secondaries and are gated by provide-xfr ACL rules. NSD supports XFR-over-TLS (RFC 9103) with mutual authentication: binding a tls-auth-name to a provide-xfr rule is intended to require the requesting secondary to present a matching X.509 client certificate, served on a dedicated tls-auth-port. The flaw is an instance of CWE-306 (Missing Authentication for Critical Function): the client-certificate check is tied to the tls-auth-port listener rather than to the provide-xfr rule itself, so the same rule's address/key conditions can be satisfied over the regular tls-port (no client cert) or plain TCP, skipping the certificate verification entirely. The affected product per CPE is cpe:2.3:a:nlnet_labs:nsd (all versions enumerated).
Know when Nsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable with no auth (the missing client-cert check is the flaw, PR:N); AC:H because it depends on a tls-auth-name config and matching provide-xfr conditions; impact is zone disclosure only (C:H, I:N, A:N).
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
1DescriptionCVE.org
When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
Executive ViewAI
NLnet Labs NSD's zone-transfer authentication control bypass allows unauthenticated attackers to extract complete DNS zone databases without required TLS client certificates, exposing organizational infrastructure details and enabling reconnaissance for further attacks. This affects any organization using NSD for authoritative DNS services with secondary nameserver configurations. The vulnerability defeats intended mutual-TLS access controls meant to restrict zone transfers to authenticated partners.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict zone-transfer access via firewall rules to known secondary nameserver IPs only; (2) Disable plaintext zone-transfer protocol (AXFR) on standard DNS ports if secondary configuration permits; (3) Monitor DNS query logs for anomalous zone-transfer requests; (4) Segment DNS infrastructure from broader network if possible; (5) Consider temporary migration of secondary zones to alternative authoritative DNS provider pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a c
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supp
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data spl
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
Exploit-DB