NSD EUVD-2026-39183

Exploitation requires that the target NSD instance (version 4.13.0 or later) is configured to serve DNS over TLS (DoT) and is reachable on its TLS listener (typically TCP/853); the attacker sends a DNS query over that DoT connection and closes the socket before reading the response. No authentication, no user interaction, and no special attacker privileges are needed (PR:N/UI:N). The key limiting factor is that DoT must be enabled - NSD deployments serving only plain UDP/TCP DNS are not exposed - and the affected version is 4.13.0+.

All available signals point to a real, easily-triggered denial-of-service risk against DoT-enabled NSD deployments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation with no special attack requirements, and the vendor explicitly describes the trigger as trivial, consistent with the high availability impact (VA:H) and the 8.7 score. Impact is strictly availability - there is no confidentiality or integrity exposure (VC:N/VI:N) and no remote code execution claimed despite the use-after-free class. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept was referenced, so exploitation is plausible but not confirmed observed in the wild. The principal limiting factor is configuration: only servers with DoT enabled are exposed, which narrows the affected population relative to the raw CVSS score.

An attacker opens a DNS-over-TLS connection to a public-facing NSD authoritative server on port 853, sends a single DNS query, and immediately closes the connection without reading the response, causing NSD to hit the use-after-free in its error-logging path and crash. Repeating this drops the authoritative DNS service for all hosted zones; because no authentication or user interaction is required, the attack can be fully scripted, though no public exploit code has been identified.