Multiple security vulnerabilities have been identified in NSD, an authoritative DNS name server, affecting versions 4.10.0 through 4.15.2. The flaws involve stack overwrites during parsing of directly supplied zone data and can allow remote code execution on primary DNS servers. The highest severity is high, and no confirmed exploitation has been reported. Environments that accept or process untrusted zone content are most exposed.
CVE-2026-101341 (CVSS 8.7 — High): This flaw occurs in NSD zone parsing for TXT, NINFO, SPF, AVC, RESINFO, and WALLET records. An attacker who supplies a crafted zone file can cause an out-of-bounds stack write that overwrites a callback function pointer, enabling arbitrary command execution.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in NSD, an authoritative DNS name server, affecting versions 4.10.0 through 4.15.2. The flaws involve stack overwrites during parsing of directly supplied zone data and can allow remote code execution on primary DNS servers. The highest severity is high, and no confirmed exploitation has been reported. Environments that accept or process untrusted zone content are most exposed.
CVE-2026-101341 (CVSS 8.7 — High): This flaw occurs in NSD zone parsing for TXT, NINFO, SPF, AVC, RESINFO, and WALLET records. An attacker who supplies a crafted zone file can cause an out-of-bounds stack write that overwrites a callback function pointer, enabling arbitrary command execution.[emaillocker id="1283"]
CVE-2026-101339 (CVSS 8.7 — High): This flaw affects parsing of Host Identity Protocol resource records in NSD. A specially crafted HIP record can cause a stack overwrite during zone file processing, allowing an attacker to execute arbitrary commands on the server.
CVE-2026-101338 (CVSS 8.7 — High): This flaw affects parsing of SVCB and HTTPS resource records in NSD. A specially crafted record can push the parser beyond its intended boundary, causing a stack overwrite that can lead to arbitrary command execution.
CVE-2026-101337 (CVSS 8.7 — High): This flaw affects base64 RDATA presentation formatting in NSD zone parsing. When base64 data is split into small chunks, the parser can miscalculate token size and write up to 64 kilobytes onto the stack, enabling arbitrary command execution.
These vulnerabilities collectively present a high risk of remote code execution on authoritative DNS servers that process untrusted zone data. Operators of primary DNS deployments, especially those using automated or customer-controlled provisioning, are most at risk. Affected environments should treat these flaws as high-priority security concerns.
We recommend you to update NLnet Labs NSD to version 4.15.3.
The following reports contain further technical details:
[/emaillocker]