Vulnerability · Published Jun 25, 2026 · Assigned by NLnet Labs

CVE-2026-12244Heap overflow and crash with crafted SVCB RR

High 8.7

In plain English

A high-severity integer overflow in NSD from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	nsd	4.14.3-r0	ALPINE-CVE-2026-12244
Debian:14	nsd	4.14.3-1	DEBIAN-CVE-2026-12244
Ubuntu:25.10	nsd	no fix listed	UBUNTU-CVE-2026-12244
Ubuntu:26.10	nsd	no fix listed	UBUNTU-CVE-2026-12244

Affected products (as reported)

Vendor	Product	Versions
NLnet Labs	NSD	4.14.0 – before 4.14.3

Weakness: CWE-190, CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt vendor-advisory