NLnet Labs Patches Four NSD Stack Overwrite Vulnerabilities

TL;DR

NLnet Labs released NSD version 4.15.3 on October 14, 2026, to fix four high-severity flaws. Each NSD stack overwrite vulnerability allows attackers to execute arbitrary commands via crafted zone files. Consequently, administrators must update their DNS servers immediately to secure their infrastructure.

Why It Matters

NSD is an open-source, authoritative DNS name server developed by NLnet Labs. Many top-level domain operators and enterprise networks rely on it to maintain critical internet infrastructure. However, exact global installation counts are not confirmed in the vendor advisories.

An NSD stack overwrite vulnerability puts primary DNS servers at severe risk of remote code execution. Specifically, the flaws trigger when NSD reads directly supplied zone files. Therefore, environments using automated or customer-controlled provisioning systems face the highest exposure. By contrast, secondary NSD instances that generate their own zone files are not vulnerable to this formatting trick. Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.

How the Attack Works

Researchers Qifan Zhang from Palo Alto Networks, Alwaleed Ashi from LXR, and Gaurang Maheta discovered the four bugs. According to the official NLnet Labs security advisories, each flaw stems from improper boundary checks during zone file parsing.

CVE-2026-101341 and CVE-2026-101339

First, CVE-2026-101341 affects TXT, NINFO, SPF, AVC, RESINFO, and WALLET records. The parser fails to verify whether text tokens under 32 bytes fit within the reserved RDATA space. As a result, an attacker can trigger an out-of-bounds stack write and overwrite a callback function pointer. Next, CVE-2026-101339 targets Host Identity Protocol (HIP) resource records. When a record fills the RDATA near its limit and adds a Rendezvous server field, it overwrites the stack with up to 191 bytes of data.

CVE-2026-101338 and CVE-2026-101337

Similarly, CVE-2026-101338 involves SVCB and HTTPS records that fill wire-format RDATA to maximum capacity. Adding an extra ECH parameter pushes the parser beyond the limit. Subsequently, the base64 decoder writes unlimited attacker-controlled data onto the stack. Finally, CVE-2026-101337 exploits a flaw in base64 RDATA presentation formatting. When base64 data splits into chunks of three characters or fewer, the parser calculates the token size as zero bytes. Thus, attackers can overwrite the stack with up to 64 kilobytes of data.

Affected Versions

Every NSD stack overwrite vulnerability in this batch affects NSD versions 4.10.0 through 4.15.2. Older releases prior to 4.10.0 and version 4.15.3 are not affected.

Patch and Mitigation Steps

NLnet Labs fixed all four vulnerabilities in NSD version 4.15.3. Administrators should upgrade to version 4.15.3 or newer right away. Alternatively, teams that cannot upgrade immediately can apply the vendor-supplied diff patches directly to the NSD source directory and recompile the software. In addition, operators should audit their provisioning pipelines to reject untrusted zone files before parsing.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.