NLnet Labs NSD up to 4.15.2 stack-based overflow

Summaryinfo

A vulnerability labeled as very critical has been found in NLnet Labs NSD up to 4.15.2. The impacted element is an unknown function. Executing a manipulation can lead to stack-based overflow. This vulnerability is registered as CVE-2026-101337. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in NLnet Labs NSD up to 4.15.2 and classified as very critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

The advisory is shared for download at nlnetlabs.nl. This vulnerability was named CVE-2026-101337 since 09/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/15/2026).

The vulnerability scanner Nessus provides a plugin with the ID 365996 (Linux Distros Unpatched Vulnerability : CVE-2026-101337), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.15.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (365996). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Domain Name Software

Vendor

• NLnet Labs

Name

• NSD

Version

• 4.15.0
• 4.15.1
• 4.15.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion