CVE-2026-101339 in NSD
Summary
by MITRE • 10/15/2026
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability described involves a stack-based buffer overflow within the Name Server Daemon (NSD), specifically triggered by the processing of Host Identity Protocol (HIP) resource records. This flaw arises when NSD parses a HIP record where the Resource Data (RDATA) field is filled to near or at its maximum limit, while simultaneously containing an additional domain name (dname) RDATA field that designates a HIP Rendezvous server. The technical root cause lies in how the software handles memory allocation and string copying for these complex records. When the parser encounters this specific configuration, it fails to correctly account for the total size of all components within the record structure during stack buffer operations. Consequently, the copy operation exceeds the allocated space on the call stack, allowing up to 191 bytes of attacker-controlled data to overwrite adjacent memory locations. This overwriting can corrupt return addresses or other critical control flow data, potentially leading to arbitrary code execution if an attacker can precisely craft the payload to exploit the overwritten pointers.
The operational impact of this vulnerability is significant for any NSD instance that accepts zone files containing such malformed HIP records from untrusted sources. Since the vulnerability requires a specific combination of record types and sizes, it represents a targeted attack vector rather than a generic parsing error. However, because DNS servers often process data provided by upstream providers or automated provisioning systems, an attacker could potentially inject these malicious records into the zone transfer process if they have control over any part of that supply chain. The note that zones written out by NSD itself for secondary roles will not exhibit this formatting is crucial; it indicates that the vulnerability is strictly related to input parsing rather than output generation or internal state corruption during normal operation. This means the attack surface is limited to instances where external zone data is directly fed into the parser, particularly in primary server configurations or when loading zones from dynamic provisioning systems.
From a classification perspective, this issue aligns with CWE-121, which covers stack-based buffer overflow vulnerabilities resulting from insufficient bounds checking during memory copy operations. In terms of attack tactics, it relates to MITRE ATT&CK techniques involving exploitation via DNS for initial access or lateral movement, specifically through the abuse of legitimate protocol features like HIP records to bypass standard security controls that might not anticipate such complex record structures. The use of a Rendezvous server field adds complexity, as attackers may leverage this feature to obfuscate their intent or trigger specific code paths within the parser that are less rigorously tested than standard domain name handling routines.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Operators running NSD must ensure they apply any available patches from the vendor that address this buffer overflow condition in HIP record parsing logic. In environments where patching is not immediately feasible, network-level filtering can be employed to block or inspect DNS traffic containing unusually large HIP records or those with specific combinations of RDATA fields known to trigger the flaw. Additionally, implementing strict input validation on any provisioning systems that feed zone data into NSD can prevent malformed records from reaching the parser in the first place. It is also advisable to run NSD instances under restricted privileges and utilize operating system-level protections such as stack canaries, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP) to mitigate the impact of any successful exploitation attempt by making it harder for attackers to achieve reliable code execution even if memory corruption occurs.