NLnet Labs NSD up to 4.15.2 RDATA Parsing parse stack-based overflow

Summaryinfo

A vulnerability described as very critical has been identified in NLnet Labs NSD up to 4.15.2. This impacts the function parse of the component RDATA Parsing. The manipulation results in stack-based overflow. This vulnerability is reported as CVE-2026-101341. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in NLnet Labs NSD up to 4.15.2. It has been classified as very critical. Affected is the function parse of the component RDATA Parsing. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

The advisory is available at nlnetlabs.nl. This vulnerability is traded as CVE-2026-101341 since 09/28/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/14/2026).

Upgrading to version 4.15.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Domain Name Software

Vendor

• NLnet Labs

Name

• NSD

Version

• 4.15.0
• 4.15.1
• 4.15.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion