Threat Intelligence Database

CVE-2026-12490 is a high-severity vulnerability in NLnet Labs NSD version 4.10.1 involving missing authentication for a critical function. Specifically, when a provide-xfr rule includes a tls-auth-name, a secondary requesting a transfer should present a client certificate matching that name. However, the vulnerability allows requests over TLS on the regular TLS port or over TCP on the regular port to bypass the client certificate requirement if other provide-xfr conditions match. This leads to missing authentication controls for critical transfer operations.

A buffer overflow vulnerability exists in NLnet Labs NSD version 4.14.0 due to improper handling of a specially crafted APL resource record with an adflength larger than allowed. This causes a stack overwrite of up to 111 attacker-controlled bytes when the zone is written to disk. The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input) and has a high severity rating with a CVSS score of 7.2.

A heap use-after-free vulnerability exists in NSD version 4.13.0 related to logging errors on TLS connections. This flaw can cause the server process to crash when a DNS query is sent over a DNS-over-TLS (DoT) connection and the connection is closed without reading the response. The vulnerability has a high severity rating with a CVSS score of 8.7.