NLnet Labs NSD: Stack overwrite via specially formatted base64 RDATA
Summary
NSD, an authoritative DNS server, contains a stack buffer overwrite in its zone-file parser. Base64 data split into pieces of three characters or less is miscalculated as zero bytes, allowing up to 64K of attacker-controlled data to overwrite the stack. The flaw requires low privileges to get a crafted zone file into the server, for example through an operator-controlled provisioning system; zones written out by NSD itself, such as secondary zones, are not formatted this way. The vendor describes possible arbitrary command execution, while CISA SSVC rates technical impact as total and automatable as no.
Affected
- NSD 4.10.0 up to and including 4.15.2
- Default configuration: unaffected according to the CNA record (see vendor advisory for details)
Fixed in
- NSD 4.15.3 and later
- Backports for older branches: Unknown.
Workaround
- No vendor-published workaround.
- Restrict who can supply zone content to the server and validate customer-supplied record data before it reaches NSD (own suggestion, not from a source).
Exploitation
- No evidence of exploitation in the wild found; KEV listing reported as No by a third-party aggregator, not verified against CISA KEV.
- No public proof of concept found; this does not prove none exists.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether NSD is installed and which version is running (nsd -v).
- If the version is 4.10.0 to 4.15.2, upgrade to NSD 4.15.3 or your distribution's patched package.
- Also apply the other zone-parser fixes in the same release (CVE-2026-101338, CVE-2026-101339, CVE-2026-101341).
- If customers or external systems can write record data into zones, prioritise the upgrade and restrict zone input until it is applied.
- Verify your distribution's fixed package version, as this was not checked.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NLnet Labs CVE-2026-101337 advisory www.nlnetlabs.nl
- NLnet Labs NSD download (4.15.3 release notes) nlnetlabs.nl
- NLnet Labs NSD security advisories nlnetlabs.nl
- Strix CVE-2026-101337 www.strix.ai
- VulDB 419800 vuldb.com
- OSV Debian CVE-2026-101337 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:11.
Original description (NVD)
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.