CVE-2026-101337 in NSD
Summary
by MITRE • 10/14/2026
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical parsing error within the Name Server Daemon (NSD) related to the handling of base64-encoded data during tokenization. Specifically, when input data is segmented into chunks containing three characters or fewer, the internal logic responsible for calculating tokens fails correctly and produces zero bytes instead of valid decoded content. This miscalculation creates a discrepancy between expected buffer sizes and actual memory operations, leading to an out-of-bounds write condition that allows attackers to overwrite stack memory with up to 64 kilobytes of attacker-controlled data. Such a flaw represents a severe integrity violation where the application fails to properly validate or bound input lengths during decoding processes, resulting in arbitrary code execution potential through stack-based buffer overflow techniques.
From a technical perspective, this issue aligns closely with CWE-120 Buffer Copy without Checking Size of Input Classic and CWE-787 Out-of-bounds Write. The root cause lies in the failure to account for padding or alignment requirements when processing small base64 fragments. Base64 encoding typically expands data by approximately 33 percent, but decoding requires handling groups of four characters to produce three bytes of output. When chunks are smaller than this standard grouping and not handled with proper boundary checks during tokenization, the resulting byte count can be erroneously calculated as zero or misaligned. This error propagates into memory allocation routines that may assume valid data presence, leading to writes beyond allocated stack limits. The ability to write 64 kilobytes of controlled data significantly increases the likelihood of successful exploitation by allowing attackers to overwrite return addresses, function pointers, or other critical control flow structures on the call stack.
The operational impact of this vulnerability is substantial for any NSD instance that processes externally fed zone files containing base64-encoded records. While native zone file generation by NSD itself does not produce such malformed segments due to internal formatting standards, external inputs remain at risk. Attackers can exploit this flaw if they have the ability to inject or manipulate DNS zone data provided through provisioning systems or direct feed mechanisms. Successful exploitation could lead to remote code execution with the privileges of the NSD process, potentially compromising the entire DNS infrastructure including cache poisoning, service disruption via denial of service, or lateral movement within the network environment by gaining access to sensitive system resources.
Mitigation strategies should focus on both immediate patching and long-term defensive coding practices. Operators must apply vendor-provided patches that correct the tokenization logic for base64 inputs with small chunk sizes. In addition to software updates, input validation mechanisms should be strengthened to ensure all incoming zone data adheres strictly to expected formatting standards before processing. Network-level controls such as DNS firewalls or intrusion detection systems can help identify anomalous query patterns associated with exploitation attempts. Furthermore, implementing stack protection features like Stack Canaries and Address Space Layout Randomization on servers running NSD adds layers of defense that mitigate the success rate of buffer overflow attacks even if the underlying vulnerability remains unpatched temporarily. Regular audits of provisioning pipelines ensure that only well-formed zone files are accepted from external sources reducing exposure to malformed input vectors.