CVE-2026-12244

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

These are all security issues fixed in the nsd-4.14.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nsd fixes the following issues:

Changes in nsd:

• Update nsd.keyring

• update to 4.14.3: https://github.com/NLnetLabs/nsd/blob/NSD_4_14_3_REL/doc/ChangeLog

  • CVE-2026-12490: Bypass of client certificate verification with transfer over TLS (bsc#1269563)
  • CVE-2026-12246: Out of bounds stack write with crafted APL RR (bsc#1269564)
  • CVE-2026-12245: Denial of DNS over TLS service by any DoT client (bsc#1269565)
  • CVE-2026-12244: Heap overflow and crash with crafted SVCB RR (bsc#1269566)

• update to 4.14.2: https://github.com/NLnetLabs/nsd/blob/NSD_4_14_2_REL/doc/ChangeLog

• update to 4.14.1: https://github.com/NLnetLabs/nsd/blob/NSD_4_14_1_REL/doc/ChangeLog

• update to 4.14.0: https://github.com/NLnetLabs/nsd/blob/NSD_4_14_0_REL/doc/ChangeLog

• update to 4.13.0: https://github.com/NLnetLabs/nsd/blob/NSD_4_13_0_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_12_1_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_12_0_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_11_1_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_11_0_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_10_1_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_10_0_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_9_1_REL/doc/ChangeLog https://github.com/NLnetLabs/nsd/blob/NSD_4_9_0_REL/doc/ChangeLog

• enable systemd notify support.

• enable dnstap support.

• enable tcp fast open support

• enable support for >= 2038

It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. (CVE-2026-12246)

It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12244)

It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12245)

It was discovered that NSD incorrectly handled TLS authentication for zone transfers. An attacker could bypass transfer security restrictions when certain conditions were met. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12490)