If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2843bb1cc8 advisory.

    * Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker     controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report     https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
    * Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action,     closing the connection early, causes a crash and restart of the server process. An attacker can keep all     children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the     report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
    * Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the     stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from     Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
    * Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS,     can bypass verification by     transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report.
    https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd3a7926a3 advisory.

    * Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker     controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report     https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
    * Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action,     closing the connection early, causes a crash and restart of the server process. An attacker can keep all     children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the     report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
    * Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the     stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from     Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
    * Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS,     can bypass verification by     transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report.
    https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bebbc065-73d2-11f1-910d-3c7c3fba4204 advisory.

    NLnet Labs reports:
    CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled     bytes.
    If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR     containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an     (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535),     causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes     Even though the data is from a configured primary inside NSD's trust boundary, we do consider the risk     significant enough for multi-tenant secondary DNS deployments, given the potential severity of the attack.
    CVE-2026-12245: An attacker can keep all children in a crash-restart loop denying DoT service.
    NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a     crash of the server process, which can be triggered trivially by sending a DNS query over a DoT     connection, and closing the connection without reading the response.
    Any client with access to the DoT port (853) can trigger this. Even though a new server process will be     immediately reforked to replace the crashed one, an attacker can keep all children in a crash-restart loop     denying DoT service.
    CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the     stack, when the zonefile is written out.
    NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than     permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum     of 111 attacker controlled bytes.
    Even though the data is from a configured primary inside NSD's trust boundary, we do consider the risk     significant enough for multi-tenant secondary DNS deployments, where a primary could introduce the rogue     APL with the secondary not noticing or only after the fact.
    CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS,     can bypass verification by transferring over TCP.
    When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a     client certificate with that name. However, no client certificate is needed when the request comes in over     TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when     the other conditions of the provide-xfr rule match.
    The transfer security restrictions for client certificates can be bypassed completely if the attacker can     match the other access control conditions, and the tls-auth-xfr-only option is not explicitly set to     yes (which it by default is not)     Thanks to people below for reporting and disclosing these vulnerabilities:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR     containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an     (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535),     causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes     (CVE-2026-12244)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8474-1 advisory.

    It was discovered that NSD incorrectly handled APL resource records with an address length larger than     permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow     when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD     server. (CVE-2026-12246)

    It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to     cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This     issue only affected Ubuntu 26.04 LTS. (CVE-2026-12244)

    It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote     attacker could use this to cause a denial of service by crashing the server process. This issue only     affected Ubuntu 26.04 LTS. (CVE-2026-12245)

    It was discovered that NSD incorrectly handled TLS authentication for zone transfers. An attacker could     bypass transfer security restrictions when certain conditions were met. This issue only affected Ubuntu     26.04 LTS. (CVE-2026-12490)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR
    containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an
    (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535),
    causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
    (CVE-2026-12244)

  - NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a
    crash of the server process, which can be triggered trivially by sending a DNS query over a DoT
    connection, and closing the connection without reading the response. (CVE-2026-12245)

  - NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than
    permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum
    of 111 attacker controlled bytes. (CVE-2026-12246)

  - When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a
    client certificate with that name. However, no client certificate is needed when the request comes in over
    TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the
    other conditions of the provide-xfr rule match. (CVE-2026-12490)

ID	Name	Product	Family	Severity
325152	Fedora 43 : nsd (2026-2843bb1cc8)	Nessus	Fedora Local Security Checks	high
325141	Fedora 44 : nsd (2026-dd3a7926a3)	Nessus	Fedora Local Security Checks	high
323941	FreeBSD : NSD -- vulnerabilities (bebbc065-73d2-11f1-910d-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	high
323499	Linux Distros Unpatched Vulnerability : CVE-2026-12244	Nessus	Misc.	high
322955	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : NSD vulnerabilities (USN-8474-1)	Nessus	Ubuntu Local Security Checks	high
443923	Alpine: multiple nsd packages: security update to 4.14.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
443923	Alpine: multiple nsd packages: security update to 4.14.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2026-12244

high

Tenable Plugins

high

high

high

high

high

high

high