CVE-2026-12245— Denial of DNS over TLS service by any DoT client
Quick assessment
Affected
NLnet Labs NSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NLnet Labs NSD是荷兰NLnet Labs组织的一款DNS服务器软件。 NLnet Labs NSD 4.13.0版本至4.14.3之前版本存在资源管理错误漏洞，该漏洞源于TLS连接日志记录中存在堆释放后重用问题，可能导致服务器进程崩溃。
Possible ATT&CK Techniques 2 AI
T1210 · Exploitation of Remote Services T1498 · Network Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NLnet Labs | NSD | 4.13.0< 4.14.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12245
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of DNS over TLS service by any DoT client
Source: CVE Program / CVE List V5
Vulnerability Description
NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
NLnet Labs NSD 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NLnet Labs NSD是荷兰NLnet Labs组织的一款DNS服务器软件。 NLnet Labs NSD 4.13.0版本至4.14.3之前版本存在资源管理错误漏洞，该漏洞源于TLS连接日志记录中存在堆释放后重用问题，可能导致服务器进程崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NLnet Labs | NSD | 4.13.0 ~ 4.14.3 | - |
|
II. Public POCs for CVE-2026-12245
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12245
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-12245 (1)
-
🔗 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt vendor-advisory
Same Patch Batch · NLnet Labs · 2026-06-25 · 4 CVEs total
| CVE-2026-12246 | Out of bounds stack write with crafted APL RR | |
| CVE-2026-12490 | Bypass of client certificate verification with transfer over TLS | |
| CVE-2026-12244 | Heap overflow and crash with crafted SVCB RR |
IV. Related Vulnerabilities
Same product: NSD
-
CVE-2026-19538
Bypass of BLOCKED ACL items on proxy protocol port over TCP -
CVE-2026-19401
Remote UDP DoS by sending multiple DNS Cookie options -
CVE-2026-18916
Remote TCP DoS by throttling the TCP receive window -
CVE-2026-18664
Wrong interpretation of ACL ranges -
CVE-2026-12490
Bypass of client certificate verification with transfer over
Same vendor: NLnet Labs
-
CVE-2026-85501
Retrap: Novel Vulnerabilities to launch Algorithmic Complexi -
CVE-2026-82720
Use-after-free in DoH stream cleanup code path -
CVE-2026-82717
CNAME synthesis could lead to heap corruption -
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when -
CVE-2026-81634
Possible heap buffer overflow during DNSSEC canonicalization
Same weakness: CWE-416
-
CVE-2026-14508
IBM DataPower Gateway Use After Free -
CVE-2026-107167
M17n-lib: heap use-after-free write in re_init_ic() -
CVE-2026-107183
llama.cpp before b11393 Use-After-Free via common_chat_peg_m -
CVE-2026-106234
Chrome 155.0.8059.39前扩展Use After Free漏洞 -
CVE-2026-106269
Chrome <155.0.8059.39 CSS释放后使用远程代码执行
V. Comments for CVE-2026-12245
No comments yet