Skip to content
OpenAdvisories
Medium WID-SEC-2026-3663 8 CVEs

OpenBSD: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Sep 29, 2026 · de-DE

Vendor: OpenBSD Product: OpenBSD

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenBSD ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Angriff durchzuführen.

Product

OpenBSD ist ein Unix-artiges Betriebssystem, abgeleitet von BSD-Unix.

Vulnerabilities 8

  • High 8.7
    CVE-2026-12244

    Heap overflow and crash with crafted SVCB RR

    If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for …

    NLnet Labs NSD nsd nsd Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-12245

    Denial of DNS over TLS service by any DoT client

    NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the re…

    NLnet Labs NSD nsd nsd Debian Ubuntu Alpine
  • High 8.2
    CVE-2026-12490

    Bypass of client certificate verification with transfer over TLS

    When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth…

    NLnet Labs NSD nsd nsd Debian Ubuntu Alpine
  • High 8.2
    CVE-2026-18664

    Wrong interpretation of ACL ranges

    When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access cou…

    NLnet Labs NSD nsd nsd Debian Ubuntu
  • High 8.2
    CVE-2026-19401

    Remote UDP DoS by sending multiple DNS Cookie options

    Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remo…

    NLnet Labs NSD nsd nsd Debian Ubuntu
  • High 8.2
    CVE-2026-19538

    Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS

    The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

    NLnet Labs NSD nsd nsd Debian Ubuntu
  • High 7.2
    CVE-2026-12246

    Out of bounds stack write with crafted APL RR

    NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

    NLnet Labs NSD nsd nsd Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2026-18916

    Remote TCP DoS by throttling the TCP receive window

    Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.

    NLnet Labs NSD nsd nsd Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References