CVE-2026-12245: NSD Heap Use-After-Free DoT Crash Vulnerability

Technical summary

CVE-2026-12245 is a heap use-after-free vulnerability (CWE-416) in NSD versions 4.13.0 and later. The defect occurs in the error logging path for TLS connections. When a DoT client closes the connection prematurely without consuming the server's response, the logging code attempts to reference memory that has already been freed, triggering a crash of the NSD process. The vulnerability is trivial to invoke—no special privileges, authentication, or network manipulation is required. Any unauthenticated remote user can send a specially sequenced DoT connection to cause denial of service.

Business impact

NSD is a critical DNS nameserver used by many organizations to host authoritative DNS zones. Availability of DNS services directly impacts business operations; outages can prevent users and systems from resolving domain names, disrupting web services, email delivery, and internal resource discovery. An attacker repeatedly exploiting this crash vulnerability could prevent legitimate DNS queries from being answered, effectively taking a DNS zone offline until the server is restarted. For organizations relying on NSD for production DNS, this represents a material availability risk. The impact scales with the number of DoT clients; environments with high DoT query volume may experience more frequent crashes.

Affected systems

NSD versions 4.13.0 and later are affected. Organizations running older versions (4.12.x and prior) are not vulnerable to this specific issue. Vulnerability affects both primary and secondary nameservers running affected versions. The attack surface is limited to DoT (DNS over TLS) connections; traditional unencrypted DNS queries over UDP and TCP are not affected. Environments with DoT enabled and accessible from untrusted networks face the greatest exposure.

Exploitability

This vulnerability has a low exploitation barrier. No special tools, credentials, or protocol knowledge beyond basic DoT client functionality is required. An attacker can craft the attack using standard TLS and DNS libraries available in most programming languages. The crash is deterministic and reliably reproducible. However, exploitation is not automated in public tools; NSD has not been added to the KEV (Known Exploited Vulnerabilities) catalog as of publication. The denial-of-service nature means the impact is temporary—service resumes after the process restarts—but the ease of reproduction makes it suitable for disruption campaigns or as part of a broader attack chain targeting DNS infrastructure.

Remediation

Apply security patches released by NLnet Labs that address the use-after-free condition in error logging. Patches are available for currently supported versions; verify the specific patched versions against the official NLnet Labs security advisory and your distribution's package repositories. As an interim mitigation, organizations can restrict DoT access to trusted clients using firewall or network access controls, reducing the exposed attack surface. Restarting the NSD process after a crash will restore service temporarily; however, patching is necessary to prevent recurrence.

Patch guidance

Check the NLnet Labs security advisory and your Linux distribution or package manager for patched NSD versions that resolve CVE-2026-12245. Update NSD as soon as patches are available. Verify the patched version against the advisory to confirm the fix is included. For organizations using binary packages, ensure your distribution's package maintainers have released updates. Test patches in a non-production environment before deployment to DNS infrastructure. Plan updates during a maintenance window to minimize service interruption during the package upgrade and NSD restart. Monitor NSD logs and process health immediately after patching to confirm stability.

Detection guidance

Monitor NSD process logs for errors related to TLS connection handling and memory management. Set up alerting for unexpected NSD process crashes or restarts, particularly if correlated with DoT query traffic spikes. Network-level detection is difficult without TLS decryption; however, organizations can monitor for patterns of DoT connection attempts followed by abrupt disconnections, which may indicate exploitation attempts. Implement process monitoring to detect and automatically restart NSD if it crashes, reducing mean time to recovery. Review your DNS query logs for evidence of DoT clients establishing connections and disconnecting without completing transactions.

Why prioritize this

This vulnerability earns HIGH priority because it enables remote denial of service with trivial exploitation requirements and no prerequisites. While not present in the KEV catalog, the low attack bar and impact to critical DNS infrastructure warrant rapid patching. Organizations operating authoritative DNS services should treat availability as a critical control objective. The specific attack vector (DoT connections) means organizations without DoT enabled face lower practical risk, but those with DoT exposed to untrusted networks should patch immediately. The deterministic nature of the crash also makes it suitable for weaponization in coordinated attacks against DNS providers or critical infrastructure operators.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability requiring no authentication or user interaction, with high availability impact and no confidentiality or integrity impact. The score correctly captures the severity: any remote attacker can crash the service. The score does not account for the specificity of the attack vector (DoT connections only) or the temporary nature of the denial of service (restarting restores service); however, for a critical service like authoritative DNS, even temporary outages carry business risk. The absence of confidentiality or integrity impact correctly prevents a CRITICAL rating.

Frequently asked questions