CVE-2026-12245: NSD Use-After-Free Vulnerability

CVE-2026-12245 Overview

CVE-2026-12245 is a heap use-after-free vulnerability in NSD (Name Server Daemon) from NLnet Labs, affecting versions from 4.13.0 onward. The flaw resides in the error logging path for TLS connections. A remote attacker can crash the NSD server process by sending a DNS query over a DNS-over-TLS (DoT) connection and closing the connection before reading the response. The condition is trivially reachable across the network, requires no authentication, and yields a denial-of-service outcome against authoritative DNS infrastructure. The vulnerability is tracked under CWE-416 (Use After Free).

Critical Impact
Unauthenticated remote attackers can crash NSD authoritative DNS servers by sending a single malformed DoT interaction, disrupting DNS resolution for hosted zones.

Affected Products

NSD 4.13.0 and later releases
Deployments exposing NSD over DNS-over-TLS (DoT)
Authoritative DNS infrastructure operated by NLnet Labs NSD users

Discovery Timeline

2026-06-25 - CVE-2026-12245 published to NVD
2026-06-25 - NLnet Labs publishes the CVE-2026-12245 advisory
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12245

Vulnerability Analysis

NSD is a high-performance authoritative DNS server widely deployed for serving DNS zones at scale. Beginning in version 4.13.0, NSD introduced or modified logic for logging errors that occur on TLS-wrapped DNS connections. That logic accesses connection-related memory after it has already been freed, producing a classic heap use-after-free condition.

An attacker establishes a DoT session to the NSD listener, transmits a DNS query, and immediately tears down the underlying TCP/TLS connection without consuming the response. NSD attempts to write the response, fails, and then references freed connection state while formatting the resulting log entry. The dereference corrupts heap state and terminates the server process.

Because NSD is the authoritative source for its configured zones, a server crash translates directly into resolution failures for downstream resolvers once cached records expire. The attack does not require valid credentials, valid zone names, or any privileged position on the network.

Root Cause

The root cause is improper lifetime management of the TLS connection context inside the error logging code path. When the peer aborts the connection mid-response, NSD frees connection structures but the error-logging routine retains and dereferences pointers into that freed memory, matching the [CWE-416] use-after-free pattern.

Attack Vector

Exploitation is performed entirely over the network against any NSD instance with DoT enabled. The attacker needs only TCP reachability to the DoT listener (typically port 853) and the ability to initiate a TLS handshake. After sending one DNS query frame, the attacker closes the socket before reading any response bytes, triggering the use-after-free during error log generation. Repeating the sequence after process restart sustains the denial-of-service condition.

No verified public exploit code is available. The vulnerability mechanism is documented in the NLnet Labs CVE-2026-12245 Advisory.

Detection Methods for CVE-2026-12245

Indicators of Compromise

Unexpected NSD process crashes or restarts coinciding with inbound DoT traffic on TCP port 853
Repeated short-lived TLS sessions from the same source that send a query frame and immediately issue a TCP FIN or RST
Core dumps from nsd referencing heap allocator functions during log message construction
Gaps in authoritative responses logged by upstream recursive resolvers

Detection Strategies

Monitor systemd, supervisord, or init logs for repeated nsd service restarts within short time windows
Inspect NSD verbosity logs for truncated error entries or messages immediately preceding a crash
Correlate TLS connection telemetry showing client-initiated abort patterns against DoT endpoints
Alert on any segmentation fault or abort signal raised by the NSD process under normal traffic conditions

Monitoring Recommendations

Track DoT connection duration distributions and flag bursts of sub-second sessions from single sources
Forward NSD process and host syslog data into a centralized analytics pipeline for crash correlation
Monitor authoritative response success rates from external vantage points to detect outages quickly
Apply rate limiting and connection accounting on the DoT listener to identify abusive clients

How to Mitigate CVE-2026-12245

Immediate Actions Required

Upgrade NSD to the fixed release published by NLnet Labs in the official advisory as soon as it is available
Inventory all NSD instances and confirm which are running version 4.13.0 or later with DoT enabled
Restrict network access to the DoT listener to known clients or trusted networks until patched
Ensure process supervision automatically restarts nsd after crashes to limit outage duration

Patch Information

NLnet Labs has documented the issue and a corresponding fix in the vendor advisory. Operators should apply the patched NSD release referenced in the NLnet Labs CVE-2026-12245 Advisory. Downstream packagers including major Linux distributions typically follow with backported updates shortly after upstream releases.

Workarounds

Temporarily disable DNS-over-TLS on NSD by removing tls-port and tls-service-key/tls-service-pem settings from nsd.conf until the patch is applied
Restrict inbound TCP 853 access via host firewall rules such as iptables or nftables to allow only authorized peers
Place NSD behind a TLS-terminating proxy that handles DoT separately, isolating the use-after-free path from direct attacker control
Increase deployment redundancy with multiple authoritative servers so a single crashed NSD does not eliminate resolution for hosted zones

bash

# Example: restrict DoT (TCP/853) to a known recursive resolver range using nftables
nft add rule inet filter input tcp dport 853 ip saddr != 198.51.100.0/24 drop

# Example: disable DoT in nsd.conf by commenting the TLS configuration
# tls-port: 853
# tls-service-key: "/etc/nsd/nsd_server.key"
# tls-service-pem: "/etc/nsd/nsd_server.pem"
systemctl restart nsd