Executive brief
NLnet Labs NSD, a high-performance authoritative DNS server, contains a flaw in how it handles secure DNS-over-TLS (DoT) connections. An attacker can repeatedly crash the server process by opening and quickly closing secure connections, leading to a denial of service. This prevents legitimate users from resolving domain names and can disrupt internet services relying on the affected server.
Technical details
A heap use-after-free vulnerability exists in NSD's error logging mechanism for TLS connections. The flaw is located in the handling of DNS-over-TLS (DoT) sessions where a client closes the connection prematurely after sending a query. This triggers a crash in the server process during the logging of the connection error. An unauthenticated remote attacker can exploit this by sending a DoT query and immediately terminating the connection, forcing the server into a crash-restart loop. The vulnerability affects versions 4.13.0 through 4.14.2 and is resolved in version 4.14.3.
Affected products
- NLnet Labs NSD 4.13.0 to 4.14.2
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched: Fixed in NSD 4.14.3