Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-101339: NSD can overwrite memory using crafted DNS record
CVE-2026-101339 · published 1 day ago
Summary
The NSD name server software from NLnet Labs and Debian can be caused to write over its own memory when it processes a specially crafted DNS record. This could let an attacker run code on the server if malicious zone data is supplied. Use only trusted zone files, apply the latest security updates, and avoid feeding NSD data from unverified provisioning systems.
What to do
- Update nlnet labs nsd to version 4.15.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nlnet labs | nsd | < 4.15.3 |
| Debian:12 | debian | nsd | All versions |
Original advisory text
DEBIAN-CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
References
- https://security-tracker.debian.org/tracker/CVE-2026-101339 Vendor Advisory
- https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta