Stack-based buffer overflow in NSD - CVE-2026-101339
Published: October 14, 2026
Vulnerability identifier: #VU155742
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101339
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the NSD zone file parser when parsing a specially crafted HIP resource record. A local user can supply a HIP record with RDATA near or at its size limit and an additional rendezvous server domain-name field to execute arbitrary commands.
The overwrite can contain up to 191 bytes of attacker-controlled data. The zone file must be supplied directly to NSD, potentially through an operator-controlled provisioning system. Zone files written by NSD itself, including those for secondary zones, do not have the formatting required to trigger the vulnerability.
Affected software
NSD
Fedora
nsd
Fedora
nsd
How to mitigate CVE-2026-101339
Install security update from vendor's website.
NSD - update to 4.15.3
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45