Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
NLnet Labs NSD from 4.10.0 before 4.15.3 is affected. When a SVCB or HTTPS record fills its wire format RDATA to the limit, another ECH parameter overwrites the stack (CWE-121), and beyond the limit the base64 decoder writes attacker-controlled data of unlimited size. A low-privileged network attacker can trigger it by supplying a crafted zone file to NSD, which could come from an operator-controlled provisioning system.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NLnet Labs | NSD | 4.10.0 to before 4.15.3 | 4.15.3 | Patch available | CNA |
- NSD VendorNLnet Labs Affected 4.10.0 to before 4.15.3 Fixed in 4.15.3 Patch available CNA
Remediation
Upgrade NLnet Labs NSD to version 4.15.3, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA NSD (NLnet Labs) Fixed in 4.15.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NLnet Labs NSD 4.15.3
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-73966 Stack overwrite in NSD from crafted TXT record RDATAPriority MEDIUM 40
- TI-2026-73965 Stack buffer overflow in NSD from crafted HIP resource recordsPriority MEDIUM 40
- TI-2026-73963 Stack overwrite in NLnet Labs NSD from specially formatted base64Priority MEDIUM 40
Vendor assessments
Timeline
- 2026-10-14 Threatist record created from CVE-2026-101338
- 2026-10-14 Alias added: GHSA-r5wh-92fx-cv6j
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-16 Priority changed: LOW → MEDIUM
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
More NLnet Labs vulnerabilities
- TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
- TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
- TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
- TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
- TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
- TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
Sources
- CVE-2026-101338 · CVE Program
- CVE-2026-101338 · NVD
- FIRST EPSS
- GHSA-r5wh-92fx-cv6j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-101338 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences