NSD 4.15.3 security release
NSD 4.15.3 fixes high-severity stack-overwrite bugs that could enable remote code execution.
Willem Toorop announced NSD 4.15.3, a security release issued on 14 October that fixes several high-severity vulnerabilities. CVE-2026-101337 is described as a remote-code-execution-class stack overwrite triggered by a specially formatted base64 RDATA field. CVE-2026-101338 is a similar stack overwrite from a crafted SVCB or HTTPS resource record. A third issue, CVE-2026-101339, is also rated high, though its description is truncated.
- NSD 4.15.3 is a security release fixing multiple high-severity bugs.
- CVE-2026-101337 is an RCE-class stack overwrite via crafted base64 RDATA.
- CVE-2026-101338 is an RCE-class stack overwrite via crafted SVCB or HTTPS records.
- CVE-2026-101339 is also rated high; the posted details are truncated.
- Products
- NSD
- Organizations
- NLnet Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-101337+2 related CVEs | Stack buffer overflow in NLnet Labs NSD base64 parsing | 8.7 | — |
From the original article
Posted by Willem Toorop on Oct 14 Several vulnerabilities were found in NSD. We released 4. 15.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.