NSD 4.15.3 security release
NSD 4.15.3 fixes high-severity stack-overwrite bugs that could enable remote code execution.
74
Vulnerability2 · 1 read
CVE-2026-101339
Stack buffer overflow in NLnet Labs NSD via HIP records
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
NLnet Labs NSD has a stack-based buffer overflow (CWE-121) when parsing a HIP resource record whose RDATA is filled near or at its limit and that also carries a dname RDATA field for a HIP Rendezvous server. A zone file supplied directly to NSD can overwrite the stack with up to 191 bytes of attacker-controlled data; zones NSD writes itself, including zones for which the server is a secondary, are not formatted in this way. Successful exploitation can compromise confidentiality, integrity, and availability of the NSD process (CVSS 4.0 8.7), but the attacker needs a way to feed the zone file, such as an operator-controlled provisioning system (PR:L). Authoritative DNS operators running affected NSD builds are the population at risk. There is no known public proof of concept and the issue is not listed in CISA KEV.
What to do: Upgrade NSD to the 4.15.3 security release. Until then, do not load zone files from untrusted or weakly controlled provisioning systems; zones NSD writes itself (including secondary zones) are not formatted in the vulnerable way. After upgrading, reload zones only from trusted sources and review provisioning pipelines that emit HIP records.
| Product | Affected |
|---|---|
| NLnet Labs NSD | Versions fixed by the NSD 4.15.3 security release (exact prior range not stated in the supplied data) |
Estimated exposure
moderatelow thousands to tens of thousands of NSD servers (order-of-magnitude estimate; vulnerable only if a crafted zone is fed in directly) — NSD is a widely used but specialized authoritative DNS server (a minority of global DNS deployments, including some large operators and TLDs); there is no public install census in the supplied data, and only servers that directly ingest a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Weakness
- CWE-121
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X