CVE-2026-101338
HighCVSS 8.7Summary
A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.
Risk Assessment
An attacker can exploit this to overwrite the stack and potentially execute malicious code, leading to DNS service compromise.
Recommendation
Update NSD to a patched version and implement integrity monitoring for zone files.
Other vulnerabilities in NSD
See all- CVE-2026-101341High
A vulnerability in NSD involves text tokens in RDATA (e.g., TXT records) under 32 bytes not being checked to stay within the reserved space, allowing arbitrary sized out-of-bounds stack writes, including overwriting a callback function pointer.
- CVE-2026-101339High
A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.
- CVE-2026-101337High
A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.
- CVE-2026-18664Critical
When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.
- CVE-2026-19401High
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a specially crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve children, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
- CVE-2026-18916High
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Original NVD description (English source)
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS