CVE-2026-12244: NSD DNS Server RCE Vulnerability

CVE-2026-12244 Overview

CVE-2026-12244 is a heap overflow vulnerability in NLnet Labs Name Server Daemon (NSD) affecting deployments configured as secondary nameservers. A malicious primary server can crash NSD or trigger memory corruption by sending an AXFR zone transfer containing a specially crafted Service Binding (SVCB) resource record. The flaw stems from an integer wrap in a uint16_t allocation size calculation when the SVCB record's rdata size reaches 65512 bytes. Exploitation yields a controlled heap write of up to 65509 bytes, placing this issue in the remote code execution class [CWE-122].

Critical Impact
An authenticated upstream primary nameserver can achieve a controlled heap overflow on a downstream NSD secondary, with potential for remote code execution.

Affected Products

NLnet Labs NSD when configured as a secondary nameserver for one or more zones
NSD instances accepting AXFR zone transfers from a primary that can send SVCB records
Refer to the NLnet Labs Advisory CVE-2026-12244 for affected version ranges

Discovery Timeline

2026-06-25 - CVE-2026-12244 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12244

Vulnerability Analysis

The vulnerability resides in NSD's parser for incoming AXFR responses, specifically in the code path that allocates memory to wrap a SVCB resource record. NSD uses a 16-bit unsigned integer to compute the total size required for the record, including its wrapper overhead. When the attacker supplies an SVCB record with an rdata field of 65512 bytes, the addition of the wrapper bytes pushes the computed length above 65535. The uint16_t value wraps to a small number, causing NSD to allocate a heap buffer far smaller than the data that will be copied into it.

The subsequent copy operation writes the full attacker-controlled payload into the undersized allocation. This produces a heap-based buffer overflow with attacker-controlled contents and length of up to 65509 bytes. Because both the size and contents of the overflow are influenced by the attacker, the condition is suitable for targeted memory corruption rather than only a crash.

Root Cause

The root cause is an integer truncation bug where a length calculation is performed in a uint16_t instead of a wider type. SVCB records (RFC 9460) permit rdata fields large enough to trigger this wrap when wrapper bytes are added. NSD trusts the primary nameserver's AXFR payload and does not range-check the intermediate computation before allocation.

Attack Vector

Exploitation requires the target NSD instance to be configured as a secondary for a zone whose primary is controlled or compromised by the attacker. The attacker initiates a zone transfer to the secondary or waits for the secondary to request one, then responds with an AXFR containing the malformed SVCB record. The bug is reachable over the network without user interaction. The privilege required corresponds to the trust relationship between secondary and primary.

No verified public proof-of-concept code is available. See the NLnet Labs Advisory CVE-2026-12244 for the vendor's technical description.

Detection Methods for CVE-2026-12244

Indicators of Compromise

Unexpected crashes or restarts of the nsd process on secondary nameservers, particularly after AXFR transactions.
AXFR responses from a primary containing SVCB resource records with rdata sizes near 65512 bytes.
Core dumps showing heap corruption in NSD's RR parsing routines.

Detection Strategies

Inspect DNS traffic on TCP port 53 between secondaries and primaries for AXFR responses carrying oversized SVCB (type 64) records.
Correlate NSD service restarts with preceding zone transfer events in syslog or systemd journals.
Hunt for anomalous parent-child process relationships originating from nsd that could indicate post-exploitation activity.

Monitoring Recommendations

Enable verbose NSD logging and forward zone transfer events to a centralized logging platform for correlation.
Alert on repeated NSD crashes or watchdog-triggered restarts on authoritative secondary servers.
Monitor outbound connections initiated by the NSD service account, which should normally be limited to zone transfer peers.

How to Mitigate CVE-2026-12244

Immediate Actions Required

Apply the patched NSD release identified in the NLnet Labs Advisory CVE-2026-12244 to all secondary nameservers.
Audit nsd.conf to enumerate every zone where NSD acts as a secondary and verify the configured primary servers.
Restrict AXFR sources using TSIG keys and IP allowlists so only trusted primaries can deliver zone transfers.

Patch Information

NLnet Labs has published a security advisory for CVE-2026-12244. Refer to the NLnet Labs Advisory CVE-2026-12244 for the fixed version numbers and upgrade instructions. Operators should upgrade NSD on all secondary nameservers and restart the service to load patched binaries.

Workarounds

Where patching is delayed, ensure primary nameservers are hardened and under exclusive administrative control to reduce the risk of a malicious AXFR.
Enforce TSIG authentication on all zone transfers and reject AXFR from any peer not explicitly listed as a primary.
Run NSD under a restricted user account with seccomp or AppArmor profiles to limit the impact of memory corruption.

bash

# Configuration example: restrict AXFR sources in nsd.conf
key:
    name: "transfer-key"
    algorithm: hmac-sha256
    secret: "<base64-secret>"

zone:
    name: "example.com"
    request-xfr: AXFR 192.0.2.53 transfer-key
    allow-notify: 192.0.2.53 transfer-key