Stack-based buffer overflow in NSD - CVE-2026-101338
Published: October 14, 2026
Vulnerability identifier: #VU155741
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101338
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the SVCB and HTTPS zone-file record parser when processing an additional ECH parameter after the wire-format RDATA has reached its capacity. A local user can supply a specially crafted zone file containing an SVCB or HTTPS record to execute arbitrary commands.
The zone file must be supplied directly to NSD, potentially through an operator-controlled provisioning system. Zone files written by NSD itself, including those for secondary zones, do not use the format required for exploitation.
Affected software
NSD
Fedora
nsd
Fedora
nsd
How to mitigate CVE-2026-101338
Install security update from vendor's website.
NSD - update to 4.15.3
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45