USN-8474-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8474-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8474-1
Upstream
Related
Published
2026-06-25T12:38:18Z
Modified
2026-06-29T13:51:19.578110262Z
Summary
NSD vulnerabilities
Details

It was discovered that NSD incorrectly handled APL resource records with an address length larger than permitted for the address family. A remote attacker could use this to cause a stack-based buffer overflow when the zone is written to disk, potentially executing arbitrary code with the privileges of the NSD server. (CVE-2026-12246)

It was discovered that NSD incorrectly handled SVCB resource records. A remote attacker could use this to cause a heap overflow, potentially executing arbitrary code with the privileges of the NSD server. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12244)

It was discovered that NSD had a use-after-free vulnerability in TLS connection error logging. A remote attacker could use this to cause a denial of service by crashing the server process. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12245)

It was discovered that NSD incorrectly handled TLS authentication for zone transfers. An attacker could bypass transfer security restrictions when certain conditions were met. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12490)

References

Affected packages

Ubuntu:Pro:16.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.7-1ubuntu0.1~esm1

Affected versions

4.*
4.1.2-1
4.1.6-1
4.1.7-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.1.7-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        },
        {
            "binary_version": "4.1.7-1ubuntu0.1~esm1",
            "binary_name": "nsd3"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12246"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}
Ubuntu:Pro:18.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.17-1ubuntu0.1~esm1

Affected versions

4.*
4.1.16-1build1
4.1.17-1
4.1.17-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.1.17-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-12246"
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}
Ubuntu:Pro:20.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.26-1ubuntu0.1~esm1

Affected versions

4.*
4.1.26-1
4.1.26-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.1.26-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12246"
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}
Ubuntu:Pro:22.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.9-1ubuntu0.1~esm1

Affected versions

4.*
4.3.5-1
4.3.7-1
4.3.8-1
4.3.8-1build1
4.3.9-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.3.9-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12246"
        }
    ],
    "ecosystem": "Ubuntu:Pro:22.04:LTS"
}
Ubuntu:Pro:24.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.8.0-1ubuntu0.1~esm1

Affected versions

4.*
4.7.0-1
4.8.0-1
4.8.0-1build1
4.8.0-1build3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.8.0-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12246"
        }
    ],
    "ecosystem": "Ubuntu:Pro:24.04:LTS"
}
Ubuntu:Pro:26.04:LTS
nsd

Package

Name
nsd
Purl
pkg:deb/ubuntu/nsd?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.14.0-1ubuntu0.1~esm1

Affected versions

4.*
4.12.0-1
4.13.0-6
4.14.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.14.0-1ubuntu0.1~esm1",
            "binary_name": "nsd"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8474-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-12244"
        },
        {
            "severity": [
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12245"
        },
        {
            "severity": [
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12246"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12490"
        }
    ],
    "ecosystem": "Ubuntu:Pro:26.04:LTS"
}