SB2026101810 - Fedora EPEL 9 update for nsd
Published: October 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2026-101337)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the NSD zone file parser when reading resource records with base64 RDATA split into tokens of three characters or fewer. A local user can supply a specially crafted zone file directly to NSD to execute arbitrary commands.
Zone files written by NSD itself, including those for secondary zones, do not use the triggering format.
2) Stack-based buffer overflow (CVE-ID: CVE-2026-101338)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the SVCB and HTTPS zone-file record parser when processing an additional ECH parameter after the wire-format RDATA has reached its capacity. A local user can supply a specially crafted zone file containing an SVCB or HTTPS record to execute arbitrary commands.
The zone file must be supplied directly to NSD, potentially through an operator-controlled provisioning system. Zone files written by NSD itself, including those for secondary zones, do not use the format required for exploitation.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-101339)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the NSD zone file parser when parsing a specially crafted HIP resource record. A local user can supply a HIP record with RDATA near or at its size limit and an additional rendezvous server domain-name field to execute arbitrary commands.
The overwrite can contain up to 191 bytes of attacker-controlled data. The zone file must be supplied directly to NSD, potentially through an operator-controlled provisioning system. Zone files written by NSD itself, including those for secondary zones, do not have the formatting required to trigger the vulnerability.
4) Stack-based buffer overflow (CVE-ID: CVE-2026-101341)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the NSD zone file parser when parsing resource records containing specially formatted sequences of strings. A local user can supply a crafted zone file directly to NSD to execute arbitrary commands.
Zone files generated by NSD itself, including those for secondary zones, do not use the formatting required to trigger the vulnerability.
Remediation
Install update from vendor's website.