NLnet Labs NSD: Stack overwrite in TXT RDATA parsing
Summary
NSD, an authoritative DNS server from NLnet Labs, does not check some RDATA text tokens under 32 bytes against the reserved space when reading zone files. A specially crafted resource record (TXT, NINFO, SPF, AVC, RESINFO or WALLET) can cause an out-of-bounds stack write, including an overwrite of a callback function pointer. The attacker needs to get the crafted record into a zone that NSD parses, for example through a provisioning system or a customer-controlled TXT record, and holds low privileges; the CVSS score of 8.7 is from the CNA, and NVD analysis is still deferred. Zones written by NSD itself, such as on secondary servers, are not formatted this way.
Affected
- NSD from 4.10.0 up to and including 4.15.2
Fixed in
- Upgrade to NSD 4.15.3 or later (vendor fix)
- For NSD 4.15.2, the vendor provides the patch patch_CVE-2026-101341.diff (apply with patch -p1, then make install)
- OpenBSD backported the fix in 8.0 errata 002
- Ubuntu lists its nsd packages as Needs evaluation; check your distribution's status
Workaround
- No vendor workaround is listed.
- Restrict write access to zone files and provisioning feeds to trusted accounts only.
- Secondary-only zones are less exposed, but an attacker with write access to the zone directory still reaches the vulnerable parser.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no.
- The vendor page states the issue can be exploited for arbitrary command execution; the vendor advisory itself describes a stack overwrite.
Our recommendation
- Patch NSD to 4.15.3 or later, or apply the vendor patch if you use a distribution build.
- Check whether your NSD instances serve zones built from customer or external input, and prioritise those systems.
- Restrict who can modify zone files and provisioning pipelines until patched.
- Monitor NSD logs and zone changes for unusual or malformed TXT records.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NLnet Labs advisory CVE-2026-101341 www.nlnetlabs.nl
- NLnet Labs NSD security advisories nlnetlabs.nl
- VulDB CVE-2026-101341 vuldb.com
- Ubuntu CVE-2026-101341 ubuntu.com
- OpenBSD 8.0 errata www.openbsd.org
- Strix CVE-2026-101341 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:11.
Original description (NVD)
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.