NSD: Stack overwrite via crafted HIP resource record in zone files
Summary
NSD, an authoritative DNS server from NLnet Labs, contains a stack overwrite in its zone file parser. A HIP resource record whose RDATA fills the field to its limit and includes a further domain name field can overwrite up to 191 bytes of stack memory with attacker-controlled data. The zone file must be fed to NSD directly, for example through an operator provisioning system, so the risk depends on who can supply zone data. Zone files written by NSD itself are not affected, and the vendor describes normal DNS queries as not triggering the flaw.
Affected
- NSD 4.10.0 up to and including 4.15.2
- Default configuration: unaffected (per the CVE record)
Fixed in
- NSD 4.15.3 and later (upstream release)
- Distribution packages: verify the fixed version in your distributor's advisory before relying on it
Workaround
- No workaround replaces the upgrade.
- Until patched, restrict who can submit or change zone data for NSD.
- Review provisioning systems, web DNS panels and scripts that write zone files for NSD.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public exploit code or in-the-wild exploitation reported at the time of research.
- CVSS 4.0 base score 8.7 (High).
Our recommendation
- If you run NSD, upgrade to 4.15.3 or later, or apply the vendor patch to 4.15.2 and reinstall.
- After the upgrade, confirm the running process reports the fixed version.
- Prioritise systems that accept zone data from third parties or external provisioning.
- If you use a managed DNS provider, ask whether they run NSD and have patched it.
- Limit and audit accounts that can write zone data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NLnet Labs advisory CVE-2026-101339 www.nlnetlabs.nl
- NSD 4.15.3 release notes (GitHub) github.com
- NLnet Labs NSD download page nlnetlabs.nl
- NLnet Labs community: NSD 4.15.3 security release community.nlnetlabs.nl
- OSV: Alpine advisory for CVE-2026-101339 osv.dev
- VulDB entry CVE-2026-101339 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:10.
Original description (NVD)
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.