CVE-2026-12490
Fixed in a distro release EPSS <1%CVSS 8.2
When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
Products: NLnet Labs NSD
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.24 | nsd | 4.14.3-r0 |
| Debian 12 | nsd | no fix |
| Debian 13 | nsd | no fix |
| Debian 14 | nsd | 4.14.3-1 |
| Ubuntu 26.10 | nsd | no fix |
| Ubuntu Pro 16.04 LTS | nsd | 4.1.7-1ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | nsd | 4.1.17-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | nsd | 4.1.26-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | nsd | 4.3.9-1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | nsd | 4.8.0-1ubuntu0.1~esm1 |
| Ubuntu Pro 26.04 LTS | nsd | 4.14.0-1ubuntu0.1~esm1 |
| openSUSE Leap 16.0 | nsd | 4.14.3-bp160.1.1 |
| openSUSE Tumbleweed | nsd | 4.14.3-1.1 |