Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-101338: NSD can be tricked into writing unlimited attacker-controlled data
CVE-2026-101338 · published 1 day ago
Summary
The NSD DNS server used on Debian and from NLnet Labs may accept specially crafted DNS records that cause it to write unlimited data into memory. This can lead to crashes or allow an attacker to take control of the server. Update NSD to the latest patched version and ensure only trusted zone files are processed.
What to do
- Update nlnet labs nsd to version 4.15.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nlnet labs | nsd | < 4.15.3 |
| Debian:12 | debian | nsd | All versions |
Original advisory text
DEBIAN-CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
References
- https://security-tracker.debian.org/tracker/CVE-2026-101338 Vendor Advisory
- https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta