Description
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | nsd3 | 3.2.5-1.squeeze2 | DSA-2515-1 |
Advisories 1
- DSA-2515-1 nsd3 - null pointer dereference Debian Security (DSA / DLA) · Mar 9, 2026