CVE-2026-12244
Heap overflow and crash with crafted SVCB RR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
| CWE | CWE-190 CWE-122 |
| Vendor | nlnet labs |
| Product | nsd |
| Published | Jun 25, 2026 |
| Last Updated | Jun 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for nlnet labs nsd
Be the first to know when new unknown vulnerabilities affecting nlnet labs nsd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
NLnet Labs / NSD
4.14.0 < 4.14.3
References
Credits
Qifan Zhang from Palo Alto Networks