Heap Use-After-Free Vulnerability in NSD by NLnet Labs
CVE-2026-12245

8.7HIGH

Key Information:

Vendor

Nlnet Labs

Status
Nsd
Vendor
CVE Published:
25 June 2026

What is CVE-2026-12245?

The NSD software by NLnet Labs is affected by a heap use-after-free vulnerability that occurs when logging errors related to TLS connections. This flaw allows for potential server crashes triggered by malicious DNS queries over a DNS over TLS (DoT) connection. When the connection is closed without reading the response, the server process can be compromised. Proper handling and timely updates are essential to mitigate risks associated with this vulnerability.

Affected Version(s)

NSD 4.13.0 < 4.14.3

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang from Palo Alto Networks
.