Nlnetlabs Nsd
12 CVEs affecting Nlnetlabs Nsd. Latest disclosed: 2026-08-26. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-12244 | High | 8.8 | 2026-06-25 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with… |
CVE-2026-12246 | High | 8.1 | 2026-06-25 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack w… |
CVE-2026-19538 | High | 7.5 | 2026-08-26 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or T… |
CVE-2026-19401 | High | 7.5 | 2026-08-26 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS C… |
CVE-2026-18916 | High | 7.5 | 2026-08-26 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cl… |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-12245 | High | 7.5 | 2026-06-25 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivi… |
CVE-2016-6173 | High | 7.5 | 2017-02-09 | NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimit… |
CVE-2013-5661 | Medium | 5.9 | 2019-11-05 | Cache Poisoning issue exists in DNS Response Rate Limiting. |
CVE-2012-2978 | | 2012-07-27 | query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference… | |
CVE-2009-1755 | | 2009-05-22 | Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers… |