Vulnerability intelligence

CVE-2026-12245

NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.

CVSS Score

8.7

High

EPSS — Exploit Probability

0.3%

Riskier than 24% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jun 30, 2026 · latest Jun 30, 2026

Coverage timeline

NLnet Labs fixes critical NSD DNS server flaws in new release
securityonline.info · Jun 30, 2026