Skip to content
OpenAdvisories
High · 8.7 CVE-2026-101337 EUVD-2026-100982GHSA-w2rq-89vw-p64m

Stack overwrite from specially formatted base64 RDATA field

Published Oct 14, 2026 · Updated Oct 14, 2026 · Assigned by NLnet Labs

Description

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

Affected products

VendorProductAffectedFixed
NLnet Labs NSD 4.10.0 – < 4.15.3 4.15.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nsd 4.15.3-1 —
Debian 13 nsd No fix yet —
Debian 12 nsd No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nsd No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS nsd No fix yet —
Ubuntu Pro 24.04 LTS nsd No fix yet —
Ubuntu Pro 22.04 LTS nsd No fix yet —
Ubuntu Pro 20.04 LTS nsd No fix yet —
Ubuntu Pro 18.04 LTS nsd No fix yet —
Ubuntu Pro 16.04 LTS nsd No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 nsd 4.14.3-r1 —
Alpine v3.23 nsd 4.13.0-r1 —
Alpine v3.22 nsd 4.12.0-r1 —
Alpine v3.21 nsd 4.11.1-r1 —

Advisories 1

References