CVE-2026-101337
8.7HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Authenticated attackers or malicious provisioning inputs can achieve remote code execution via a stack-based buffer overflow. They need the ability to load a crafted zone file directly into NSD.
Root cause
A stack-based buffer overflow occurs because base64 data split into chunks of 3 characters or fewer miscalculates token lengths to produce 0 bytes, allowing up to 64KB of stack memory to be overwritten.
Affected systems
NLnet Labs NSD; specific affected versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to the patched NSD version specified in the vendor advisory. As an interim mitigation, restrict zone file imports to trusted sources and validate that zone files do not contain base64 records split into chunks of three characters or fewer.
$ nsd -vAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).