By vendor

Nlnetlabs vulnerabilities

Known CVEs affecting Nlnetlabs products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-12244HIGH 8.8

  NSD, the authoritative DNS server from NLnet Labs, contains a critical vulnerability in how it processes zone transfers from a primary DNS server. When configured as a secondary server, NSD can be crashed and potentially exploited for remote code execution if an attacker controls the primary server and sends a specially crafted DNS SVCB record during a zone transfer. The vulnerability stems from an integer overflow in a variable used to allocate memory for the record, allowing an attacker to write up to 65,509 bytes to heap memory.

• CVE-2026-12246HIGH 8.1

  NSD, a popular authoritative DNS nameserver, contains a stack buffer overflow vulnerability triggered when processing specially crafted APL (Address Prefix List) resource records. An authenticated attacker can craft a malicious zone file with an APL record that declares a larger address length than is valid for its address family, causing up to 111 bytes of attacker-controlled data to overwrite the stack when the zone is written to disk. This vulnerability affects NSD version 4.14.0 and requires the attacker to have zone transfer or update privileges.

• CVE-2026-10846HIGH 7.5

  NLnet Labs ldns, a DNS library used by many applications for DNS resolution, contains a critical validation flaw in its UDP stub resolver implementation. When applications use ldns to resolve DNS queries over UDP, the library fails to properly verify that responses match their requests—it doesn't check the source address, port, query ID, or even the question being asked. This oversight enables attackers on the network to inject malicious DNS responses without being on the direct path between the client and the legitimate DNS server, a technique known as off-path poisoning. The drill diagnostic tool bundled with ldns is directly affected.

• CVE-2026-12245HIGH 7.5

  NSD, a DNS nameserver software maintained by NLnet Labs, contains a memory safety defect that causes the server to crash when processing certain DNS-over-TLS (DoT) connections. An attacker can trivially trigger this crash by opening a DoT connection, sending a DNS query, and closing the connection before the response is read. The underlying issue is improper memory cleanup during error logging on these connections, allowing the freed memory to be accessed after it has been deallocated. While this does not enable data theft or system compromise, repeated crashes can degrade service availability.

• CVE-2026-12490HIGH 7.5

  CVE-2026-12490 is a TLS authentication bypass in NLnet Labs NSD, a popular authoritative DNS server. The vulnerability allows a secondary nameserver to request zone transfers without providing the required client certificate when the transfer request arrives over standard TLS or TCP ports, even though the primary server is configured to demand certificate authentication. An attacker can exploit this to request sensitive DNS zone data if they can reach the server over the network, bypassing what administrators believed was a protected channel.

• CVE-2026-49233HIGH 7.5

  Routinator, a critical tool for validating BGP route origins, contains a path traversal vulnerability in how it processes rsync module names. An attacker can craft a malicious rsync URI with directory traversal sequences (like ..) in the module component, allowing unauthorized access to files outside the intended cache directory. This could expose the entire rsync cache to an unauthenticated attacker over the network.

• CVE-2026-49234HIGH 7.5

  Routinator, an open-source RPKI relying party software maintained by NLnet Labs, crashes when it receives a malformed (non-UTF-8 encoded) query parameter in API requests. An attacker sending a specially crafted string to the /api/v1/origins endpoint can trigger a denial-of-service condition that takes the service offline. The vulnerability only affects deployments that expose the Routinator API to untrusted networks without additional access controls.

• CVE-2026-49235HIGH 7.5

  Routinator, a RPKI validator from NLnet Labs, crashes when processing specially crafted XML files delivered through the RRDP protocol. An attacker can trigger this denial-of-service condition remotely without authentication, making the service unavailable to legitimate users who depend on it for RPKI validation.