Description
Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nsd | 2.3.7-3 | — |
| Debian 13 | nsd | 2.3.7-3 | — |
| Debian 12 | nsd | 2.3.7-3 | — |
| Debian 5.0 | nsd | 2.3.7-1.1+lenny1 | DSA-1803-1 |
| Debian 5.0 | nsd3 | 3.0.7-3.lenny2 | DSA-1803-1 |
| Debian 4.0 | nsd | 2.3.6-1+etch1 | DSA-1803-1 |
Advisories 1
- DSA-1803-1 nsd nsd3 - denial of service Debian Security (DSA / DLA) · Mar 9, 2026