Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-101337: NSD on Debian can overwrite memory with crafted data
CVE-2026-101337 · published 1 day ago
Summary
The NSD DNS server used in Debian can be tricked into writing up to 64KB of attacker‑controlled data onto its memory stack when it processes certain small base64 fragments. This could allow an attacker to take control of the server or cause it to crash. Apply the latest security update for NSD on Debian or upgrade to a patched version as soon as possible.
What to do
- Update nlnet labs nsd to version 4.15.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nlnet labs | nsd | < 4.15.3 |
| Debian:12 | debian | nsd | All versions |
Original advisory text
DEBIAN-CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
References
- https://security-tracker.debian.org/tracker/CVE-2026-101337 Vendor Advisory
- https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta