CVE-2026-12245

NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) NSD a partir de la versión 4.13.0 tiene un error de uso después de liberación en el heap al registrar errores en conexiones TLS, causando una caída del proceso del servidor, que puede ser activado trivialmente enviando una consulta DNS a través de una conexión DoT y cerrando la conexión sin leer la respuesta.

Information

Published : 2026-06-25 07:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12245

Mitre link : CVE-2026-12245

CVE.ORG link : CVE-2026-12245

JSON object : View

Products Affected

nlnetlabs

nsd

CWE

CWE-416

Use After Free

{"id": "CVE-2026-12245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T12:42:22.635356Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "NSD", "versions": [{"status": "affected", "version": "4.13.0", "lessThan": "4.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-25T07:16:45.080", "references": [{"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt", "tags": ["Patch", "Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response."}, {"lang": "es", "value": "NSD a partir de la versi\u00f3n 4.13.0 tiene un error de uso despu\u00e9s de liberaci\u00f3n en el heap al registrar errores en conexiones TLS, causando una ca\u00edda del proceso del servidor, que puede ser activado trivialmente enviando una consulta DNS a trav\u00e9s de una conexi\u00f3n DoT y cerrando la conexi\u00f3n sin leer la respuesta."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CFD6DBF-22D2-4A34-8BF9-D013F53DCCA9", "versionEndExcluding": "4.14.3", "versionStartIncluding": "4.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}