8.7
Élevée
CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS…
Description
If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NSD 4.14 | 4.14.0 → < 4.14.3 | 4.14.3 |
Autres CVE de NSD
Les 13 CVE de NSD →
CVE-2026-101341
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved…
8.7
Élevée
CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous…
8.7
Élevée
CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the…
8.7
Élevée
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes
8.7
Élevée