Skip to content
OpenAdvisories
High · 8.7 CVE-2026-101341 EUVD-2026-100985GHSA-22wp-v7fq-g3x8

Stack overwrite from specially formatted TXT-DATA RDATA field

Published Oct 14, 2026 · Updated Oct 14, 2026 · Assigned by NLnet Labs

Description

Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

Affected products

VendorProductAffectedFixed
NLnet Labs NSD 4.10.0 – < 4.15.3 4.15.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nsd 4.15.3-1 —
Debian 13 nsd No fix yet —
Debian 12 nsd No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nsd No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS nsd No fix yet —
Ubuntu Pro 24.04 LTS nsd No fix yet —
Ubuntu Pro 22.04 LTS nsd No fix yet —
Ubuntu Pro 20.04 LTS nsd No fix yet —
Ubuntu Pro 18.04 LTS nsd No fix yet —
Ubuntu Pro 16.04 LTS nsd No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 nsd 4.14.3-r1 —
Alpine v3.23 nsd 4.13.0-r1 —
Alpine v3.22 nsd 4.12.0-r1 —
Alpine v3.21 nsd 4.11.1-r1 —

Advisories 1

References