PatchTheCVEnsd vulnerabilities and fixes
Recent CVEs affecting nsd, with upgrade or downgrade steps. 4 tracked.
nsd has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-06-25. Highest priority: CVE-2026-12244 (score 41/100).
- CVE-2026-12244 HIGH 8.8 UPGRADE If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a
- CVE-2026-12245 HIGH 7.5 UPGRADE NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of
- CVE-2026-12246 HIGH 8.1 UPGRADE NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted
- CVE-2026-12490 HIGH 7.5 UPGRADE When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client ce
FAQ
How do I fix nsd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nsd being exploited right now?
None of the tracked nsd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nsd CVE should I patch first?
CVE-2026-12244 currently ranks highest (41/100): If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a.