CVE-2026-101338

CVE-2026-101338 is a stack-based buffer overflow (CWE-121) in NLnet Labs NSD when parsing SVCB or HTTPS resource records in a zone file. If the wire-format RDATA is already full, an additional ECH parameter can overwrite the stack, and past that limit the base64 decoder can write an unlimited amount of attacker-controlled data. The zone must be fed to NSD directly—for example from an operator-controlled provisioning system—because zone files NSD itself writes, including secondary zones, are not formatted this way. A successful overflow can compromise confidentiality, integrity, and availability of the NSD process (CVSS 4.0 8.7, network vector, low privileges required). It is not on the CISA KEV list, and no public proof-of-concept is known.

What to do: Upgrade NSD to the 4.15.3 security release or later and confirm the running version after restart. Until then, do not load zone files supplied by untrusted or weakly controlled provisioning systems; zones NSD itself writes (including secondary zones) are not formatted in the vulnerable way.