Stack overwrite in NSD from crafted TXT record RDATA
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
NSD from 4.10.0 before 4.15.3 does not check that short text tokens in RDATA, such as TXT records, stay within their reserved space. This stack-based buffer overflow (CWE-121) lets writes go out of bounds, including over a callback function pointer called right after parsing. An attacker with low privileges can trigger it over the network, for example through a zone file from an operator-controlled provisioning system.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NLnet Labs | NSD | 4.10.0 to before 4.15.3 | 4.15.3 | Patch available | CNA |
- NSD VendorNLnet Labs Affected 4.10.0 to before 4.15.3 Fixed in 4.15.3 Patch available CNA
Remediation
Upgrade NSD to fixed version 4.15.3.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA NSD (NLnet Labs) Fixed in 4.15.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NLnet Labs NSD 4.15.3
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-73965 Stack buffer overflow in NSD from crafted HIP resource recordsPriority MEDIUM 40
- TI-2026-73964 Stack overwrite from a specially crafted and formatted SVCB or HTTPS RRPriority MEDIUM 40
- TI-2026-73963 Stack overwrite in NLnet Labs NSD from specially formatted base64Priority MEDIUM 40
Vendor assessments
Timeline
- 2026-10-14 Threatist record created from CVE-2026-101341
- 2026-10-14 Alias added: GHSA-22wp-v7fq-g3x8
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-16 Priority changed: LOW → MEDIUM
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
More NLnet Labs vulnerabilities
- TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
- TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
- TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
- TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
- TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
- TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
Sources
- CVE-2026-101341 · CVE Program
- CVE-2026-101341 · NVD
- FIRST EPSS
- GHSA-22wp-v7fq-g3x8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-101341 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences