CVE-2026-12244: Heap overflow and crash with crafted SVCB RR
If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nsdto a version that resolves this vulnerability.Fixed in 4.3.5-1Fixed in 4.6.1-1Fixed in 4.12.0-1Fixed in 4.14.3-1 - Upgrade
Upgrade
nsdto a version that resolves this vulnerability.Fixed in 4.14.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12244?
CVE-2026-12244 has a severity rating of high with a CVSS score of 8.7.
How do I fix CVE-2026-12244?
To mitigate CVE-2026-12244, ensure that NSD is properly configured and consider updating to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-12244?
CVE-2026-12244 affects instances of NSD configured as secondary for a zone.
What kind of attack does CVE-2026-12244 enable?
CVE-2026-12244 allows an attacker to crash NSD by sending a crafted SVCB RR with a specific rdata size.
What is the impact of exploiting CVE-2026-12244?
Exploiting CVE-2026-12244 can lead to service disruption and downtime for systems relying on NSD for DNS resolution.