CVE-2026-12246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12246", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-06-15T06:47:44.761Z", "datePublished": "2026-06-25T05:24:29.512Z", "dateUpdated": "2026-06-25T12:42:05.428Z"}, "containers": {"cna": {"title": "Out of bounds stack write with crafted APL RR", "references": [{"tags": ["vendor-advisory"], "url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 4.14.3."}], "affected": [{"defaultStatus": "unaffected", "product": "NSD", "vendor": "NLnet Labs", "versions": [{"version": "4.14.0", "lessThan": "4.14.3", "status": "affected", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang from Palo Alto Networks"}, {"lang": "en", "type": "finder", "value": "Haruki Oyama from Waseda University"}, {"lang": "en", "type": "finder", "value": "zhangph"}], "timeline": [{"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Haruki Oyama"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch with Qifan Zhang and Haruki Oyama"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "Haruki Oyama verifies patch"}, {"lang": "en", "time": "2026-06-15T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-06-16T00:00:00.000Z", "value": "Issue reported by zhangph"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch with zhangph"}, {"lang": "en", "time": "2026-06-25T00:00:00.000Z", "value": "Fix released with version 4.14.3"}], "datePublic": "2026-06-25T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes."}], "metrics": [{"scenarios": [{"lang": "en", "value": "Processing of a zone containing a crafted APL can crash NSD when writing the zone to disk. These zones can be provided by a trusted primary"}], "cvssV4_0": {"baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input", "lang": "en", "type": "CWE"}, {"cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-25T05:24:29.512Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T12:41:56.092027Z", "id": "CVE-2026-12246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:42:05.428Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T12:41:56.092027Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T12:42:00.963Z"}}], "cna": {"title": "Out of bounds stack write with crafted APL RR", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang from Palo Alto Networks"}, {"lang": "en", "type": "finder", "value": "Haruki Oyama from Waseda University"}, {"lang": "en", "type": "finder", "value": "zhangph"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "Processing of a zone containing a crafted APL can crash NSD when writing the zone to disk. These zones can be provided by a trusted primary"}]}], "affected": [{"vendor": "NLnet Labs", "product": "NSD", "versions": [{"status": "affected", "version": "4.14.0", "lessThan": "4.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Qifan Zhang"}, {"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Issue reported by Haruki Oyama"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch with Qifan Zhang and Haruki Oyama"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "Haruki Oyama verifies patch"}, {"lang": "en", "time": "2026-06-15T00:00:00.000Z", "value": "Qifan Zhang verifies patch"}, {"lang": "en", "time": "2026-06-16T00:00:00.000Z", "value": "Issue reported by zhangph"}, {"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "NLnet Labs shares patch with zhangph"}, {"lang": "en", "time": "2026-06-25T00:00:00.000Z", "value": "Fix released with version 4.14.3"}], "solutions": [{"lang": "en", "value": "This issue is fixed starting with version 4.14.3."}], "datePublic": "2026-06-25T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input"}, {"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-25T05:24:29.512Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12246", "state": "PUBLISHED", "dateUpdated": "2026-06-25T12:42:05.428Z", "dateReserved": "2026-06-15T06:47:44.761Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-06-25T05:24:29.512Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "NSD", "vendor": "NLnet Labs", "versions": [{"lessThan": "4.14.3", "status": "affected", "version": "4.14.0", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "25173995-D8AF-4D73-BAA0-96D17AC63710", "versionEndExcluding": "4.14.3", "versionStartIncluding": "4.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes."}, {"lang": "es", "value": "La versi\u00f3n 4.14.0 de NSD introdujo un error donde un APL RR especialmente dise\u00f1ado, con una longitud de adflength mayor de la permitida para la familia de direcciones, sobrescribir\u00e1 la pila cuando la zona se escribe en el disco, con un m\u00e1ximo de 111 bytes controlados por el atacante."}], "id": "CVE-2026-12246", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12246", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T12:41:56.092027Z", "version": "2.0.3"}}]}, "published": "2026-06-25T07:16:45.197", "references": [{"source": "sep@nlnetlabs.nl", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-120"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{"bugzilla": {"description": "nsd: Out of bounds stack write with crafted APL RR", "id": "2491589", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491589"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.", "A flaw was found in NSD. A remote attacker, operating as a configured primary DNS server in a multi-tenant secondary DNS deployment, could exploit a bug involving specially crafted Address Prefix List (APL) resource records. By providing an APL record with an adflength larger than permitted, the attacker can overwrite the stack when the zone is written to disk. This could lead to arbitrary code execution or a denial of service."], "name": "CVE-2026-12246", "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12246\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12246"], "statement": "This is an Important flaw in NSD, affecting multi-tenant secondary DNS deployments. A remote attacker, acting as a configured primary DNS server, can exploit a specially crafted Address Prefix List (APL) resource record to cause a stack overwrite when the zone is written to disk. This could lead to arbitrary code execution or a denial of service on the secondary DNS server. The vulnerability requires the attacker to be a trusted primary, but the risk is significant in multi-tenant environments.\nThis vulnerability doesn't affect any supported Red Hat Product.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.0,4.14.3)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "NSD", "source": "cna", "vendor": "NLnet Labs"}, "product": "nsd", "vendor": "nlnetlabs"}], "created": "2026-06-25T08:00:15.898740+00:00", "updated": "2026-06-30T02:00:05.098339+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$nsd"]}