Stack overwrite in NLnet Labs NSD from specially formatted base64
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
NLnet Labs NSD from 4.10.0 before 4.15.3 is affected. When base64 data is split into pieces of 3 characters or less, the token size is miscalculated to produce 0 bytes, a stack-based buffer overflow (CWE-121). An attacker with low privileges who can supply a zone file directly to NSD can overwrite the stack with up to 64K of attacker controlled data.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NLnet Labs | NSD | 4.10.0 to before 4.15.3 | 4.15.3 | Patch available | CNA |
- NSD VendorNLnet Labs Affected 4.10.0 to before 4.15.3 Fixed in 4.15.3 Patch available CNA
Remediation
Upgrade NLnet Labs NSD to version 4.15.3, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA NSD (NLnet Labs) Fixed in 4.15.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NLnet Labs NSD 4.15.3
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-73966 Stack overwrite in NSD from crafted TXT record RDATAPriority MEDIUM 40
- TI-2026-73965 Stack buffer overflow in NSD from crafted HIP resource recordsPriority MEDIUM 40
- TI-2026-73964 Stack overwrite from a specially crafted and formatted SVCB or HTTPS RRPriority MEDIUM 40
Vendor assessments
Timeline
- 2026-10-14 Threatist record created from CVE-2026-101337
- 2026-10-14 Alias added: GHSA-w2rq-89vw-p64m
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-16 Priority changed: LOW → MEDIUM
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
More NLnet Labs vulnerabilities
- TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
- TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
- TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
- TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
- TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
- TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
Sources
- CVE-2026-101337 · CVE Program
- CVE-2026-101337 · NVD
- FIRST EPSS
- GHSA-w2rq-89vw-p64m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-101337 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences