CVE-2026-12244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12244", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-15T06:46:44.866Z", "datePublished": "2026-06-25T05:24:08.548Z", "dateUpdated": "2026-06-25T12:45:34.403Z"}, "containers": {"cna": {"title": "Heap overflow and crash with crafted SVCB RR", "references": [{"tags": ["vendor-advisory"], "url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 4.14.3."}], "affected": [{"defaultStatus": "unaffected", "product": "NSD", "vendor": "NLnet Labs", "versions": [{"version": "4.14.0", "lessThan": "4.14.3", "status": "affected", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang from Palo Alto Networks"}], "timeline": [{"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-15T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-06-25T00:00:00.000Z", "value": "Fix released with version 4.14.3"}], "datePublic": "2026-06-25T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes"}], "metrics": [{"scenarios": [{"lang": "en", "value": "Processing of a zonefile containing a crafted SVCB. These can be provided by a trusted primary"}], "cvssV4_0": {"baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}, {"cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-25T05:24:08.548Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T12:45:15.927329Z", "id": "CVE-2026-12244", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:45:34.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12244", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T12:45:15.927329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:45:30.211Z"}}], "cna": {"title": "Heap overflow and crash with crafted SVCB RR", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang from Palo Alto Networks"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "Processing of a zonefile containing a crafted SVCB. These can be provided by a trusted primary"}]}], "affected": [{"vendor": "NLnet Labs", "product": "NSD", "versions": [{"status": "affected", "version": "4.14.0", "lessThan": "4.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch"}, {"lang": "en", "time": "2026-06-15T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-06-25T00:00:00.000Z", "value": "Fix released with version 4.14.3"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 4.14.3."}], "datePublic": "2026-06-25T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}, {"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-25T05:24:08.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12244", "state": "PUBLISHED", "dateUpdated": "2026-06-25T12:45:34.403Z", "dateReserved": "2026-06-15T06:46:44.866Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-06-25T05:24:08.548Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "NSD", "vendor": "NLnet Labs", "versions": [{"lessThan": "4.14.3", "status": "affected", "version": "4.14.0", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "25173995-D8AF-4D73-BAA0-96D17AC63710", "versionEndExcluding": "4.14.3", "versionStartIncluding": "4.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes"}, {"lang": "es", "value": "Si NSD est\u00e1 configurado como secundario para una zona, el primario de esa zona puede bloquear NSD con un AXFR que contenga un mensaje DNS con un RR SVCB especialmente dise\u00f1ado con un tama\u00f1o de rdata de 65512, que permite que una variable (uint16_t) utilizada para asignar el espacio necesario para el RR se desborde (porque el tama\u00f1o total > 65535), causando un desbordamiento de mont\u00edculo. El atacante puede realizar una escritura controlada en la cabecera (de clase RCE) de hasta 65509 bytes."}], "id": "CVE-2026-12244", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12244", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T12:45:15.927329Z", "version": "2.0.3"}}]}, "published": "2026-06-25T07:16:44.900", "references": [{"source": "sep@nlnetlabs.nl", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "nsd: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes.", "id": "2491587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491587"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes", "A flaw was found in nsd. When nsd is configured as a secondary server for a zone, a remote attacker, acting as the primary server for that zone, can send a specially crafted DNS message within an AXFR (Asynchronous Full Zone Transfer) request. This message, containing a malformed SVCB (Service Binding) resource record, can cause a heap overflow, leading to arbitrary code execution. This vulnerability poses a significant risk, especially in multi-tenant secondary DNS deployments, due to the potential for a controlled write of a large amount of data."], "name": "CVE-2026-12244", "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12244\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12244"], "statement": "This Important vulnerability in NSD allows a remote attacker, acting as a configured primary DNS server, to trigger a heap overflow during an AXFR zone transfer. This can lead to arbitrary code execution on the secondary NSD server. The risk is particularly significant in multi-tenant environments where NSD serves as a secondary for multiple zones, as a compromised primary could exploit this flaw within NSD's trust boundary.\nThis vulnerability doesn't affect any supported Red Hat Product.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.0,4.14.3)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "NSD", "source": "cna", "vendor": "NLnet Labs"}, "product": "nsd", "vendor": "nlnetlabs"}], "created": "2026-06-25T07:30:17.063145+00:00", "updated": "2026-06-30T02:00:05.098624+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$nsd"]}