DEV Community

andreagomez
andreagomez

Posted on

Blast radius of a compromised authoritative server: NSD 4.15.3 and its four CVEs

#dns #nsd #vulnerability #cve2026101338

Blast radius of a compromised authoritative server: NSD 4.15.3 and its four CVEs

Most vulnerability write-ups stop at the vulnerable process. For an authoritative DNS server, that stopping point is misleading. The process under attack answers queries for every domain it hosts, and its answers propagate into caches across the internet. NSD 4.15.3 closes four stack overwrite flaws that reach that position, and the deployment role of each server decides how far the consequences travel.

The facts

NLnet Labs published NSD 4.15.3 on 14 October 2026 for four flaws affecting versions 4.10.0 through 4.15.2: CVE-2026-101338, CVE-2026-101339, CVE-2026-101341 and CVE-2026-101337. Each is a stack overwrite during zone-file parsing, each is described by the vendor as exploitable for execution of arbitrary commands, and each requires a crafted zone file delivered directly to the parser. SecurityOnline reports CVSS v4 scores of 8.7 with no public exploit and no confirmed in-the-wild use.

What the process actually controls

An authoritative server holds the zone data for the domains it serves and produces the answers that recursive resolvers cache. Compromise of that process has three distinct consequences.
The first is disclosure. Zone contents include records that describe internal services if the operator placed them there, and they include delegation and DNSSEC material.
The second is answer integrity. A compromised authoritative server can return records that the domain owner never published. Because resolvers cache answers for the record's TTL, forged responses persist after the attacker is gone, and stale caches spread the effect beyond the immediate network.
The third is propagation to secondaries. A primary that has been modified can push poisoned content outward through normal AXFR or IXFR transfers, and healthy secondaries will accept it as authoritative.

Role-based priority

The vendor constraint narrows the first wave of patching. Zone files written by NSD itself, such as those produced for a secondary from a transfer, will not be formatted the way the attacks require. That makes the highest-priority group the servers that parse files produced elsewhere.
| Deployment role | Zone data source | Relative urgency |
| --- | --- | --- |
| Managed DNS platform | Customer input rendered by panel software | Highest |
| Provisioning-driven primary | Templates or scripts in a deployment pipeline | High |
| Internal primary | Administrator-maintained zone files | Medium |
| Secondary only | Transfers written by a peer NSD | Lower, but not zero |
| Lab or staging | Whatever the test tooling emits | Medium, for shared tooling |
Even the lower rows deserve the patch. Write access to the zone directory is enough to deliver a malicious file, so any account that can write there becomes a route into the parser.

Signals worth watching

Memory corruption in a parser rarely produces a polite error. It produces a crash, a supervisor restart, or a daemon that dies during a reload. Three signals are worth collecting now.

  • Unexpected process exits from the NSD service, with timestamps correlated to zone reloads.
  • Supervisor or container restart counts for the DNS workload, alerting on any restart that coincides with a zone change.
  • Reload events triggered by accounts that normally do not touch DNS, which may indicate a compromised provisioning credential. Zone validation results also help. Running nsd-checkzone from 4.15.3 against production zones before the upgrade shows which existing files the fixed parser treats as suspicious.

Exposure context

Internet measurement can size the population without identifying the vulnerable subset. At the time of writing, ZoomEye returned 116,266 assets for app="NSD" and 628,831 for the looser banner="NSD", while vul.cve="CVE-2026-101338" returned zero shortly after disclosure. None of these figures indicate version, role, or whether a server accepts zone uploads.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOU0Qi

Remediation

Upgrade to NSD 4.15.3: https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz. If the release cannot be deployed immediately, per-CVE diffs against 4.15.2 are published, such as https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101341.diff, applied from the source directory with patch -p1 then make install.
After restart, confirm the live process reports the fixed build. For fleets, prefer replacing images or packages over patching running hosts, so that the change is reproducible and the version is auditable.

References

Top comments (0)