Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-101341: NSD may run malicious code from crafted DNS data
CVE-2026-101341 · published 1 day ago
Summary
The NSD DNS server used in Debian can be caused to write beyond its memory limits when it processes specially crafted short text records. This can let an attacker overwrite a function pointer and execute arbitrary code, but only if they can supply a malicious zone file to the server. Update NSD to the latest patched version to prevent this risk.
What to do
- Update nlnet labs nsd to version 4.15.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nlnet labs | nsd | < 4.15.3 |
| Debian:12 | debian | nsd | All versions |
Original advisory text
DEBIAN-CVE-2026-101341
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
References
- https://security-tracker.debian.org/tracker/CVE-2026-101341 Vendor Advisory
- https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta