CVE-2026-101337

CVE-2026-101337 is a stack-based buffer overflow (CWE-121) in NLnet Labs NSD’s handling of base64 data in zone files. When base64 input is split into pieces of three characters or fewer, token lengths are miscalculated as zero bytes, which lets an attacker overwrite the stack with up to 64 KB of controlled data and can yield high confidentiality, integrity, and availability impact on the server. The flaw is triggered only when a crafted zone file is fed directly to NSD; zones that NSD itself writes, including those for which it is a secondary, are not formatted in the vulnerable way, though a zone could still arrive from an operator-controlled provisioning system. Low privileges are required (CVSS 4.0 8.7). It is not listed in CISA KEV and no public proof-of-concept is known; NLnet Labs addressed it in the NSD 4.15.3 security release.

What to do: Upgrade NSD to the 4.15.3 security release (or any later fixed build from NLnet Labs) and restart the daemon so the base64 parser fix is loaded. Until then, only load zone files produced by NSD itself or by a trusted provisioning path, and reject or re-validate externally supplied zones that contain unusually split base64 data.