8.2
High
CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client…
Description
When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NSD 4.10 | 4.10.1 → < 4.14.3 | 4.14.3 |
Other CVEs of NSD
The 13 CVEs of NSD →
CVE-2026-101341
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved…
8.7
High
CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous…
8.7
High
CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the…
8.7
High
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes
8.7
High