NSD could be made to crash or run programs if it received specially crafted network traffic.
It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. ( CVE-2026-12246 ) It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12244 ) It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. (
It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. ( CVE-2026-12246 )
It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12244 )
It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. (
It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. ( CVE-2026-12246 ) It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12244 ) It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12245 ) It was discovered that NSD incorrectly handled TLS authentication for zone transfers. An attacker could bypass transfer security restrictions when certain conditions were met. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12490 )
It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. ( CVE-2026-12246 )
It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12244 )
It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12245 )
It was discovered that NSD incorrectly handled TLS authentication for zone transfers. An attacker could bypass transfer security restrictions when certain conditions were met. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-12490 )
In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions:
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
