DEV Community

Ioneyrezende
Ioneyrezende

Posted on

Six minor releases of exposure: what the NSD 4.10.0 to 4.15.2 range says about patch cadence

#vulnerability #dns #nsd

Six minor releases of exposure: what the NSD 4.10.0 to 4.15.2 range says about patch cadence

The version range in the October 2026 NSD advisories deserves its own reading. NSD 4.10.0 through 4.15.2 is not a single release behind; it spans a long stretch of upstream development, and every release in that stretch carries the same four stack overwrite flaws. For anyone who owns authoritative DNS infrastructure, the range is a comment on release hygiene as much as on the bugs themselves.

The vulnerability facts, briefly

On 14 October 2026 NLnet Labs published four advisories and released NSD 4.15.3 with fixes. CVE-2026-101341 covers TXT, NINFO, SPF, AVC, RESINFO and WALLET records; CVE-2026-101339 covers HIP records; CVE-2026-101338 covers SVCB and HTTPS records; CVE-2026-101337 covers base64 RDATA presentation formatting. Each is rated High, each results in an out-of-bounds stack overwrite during zone-file parsing that can be exploited for arbitrary command execution, and each affects every version from 4.10.0 up to and including 4.15.2. Version 4.15.3 is not affected.

The trigger condition is identical across the four. A crafted record must be present in a zone file the daemon reads directly. Zone files NSD generates itself are not formatted in the vulnerable way, and the vendor identifies operator-controlled provisioning systems as the realistic delivery channel.

What a wide affected range implies

A range that wide means the bugs were not introduced by a recent refactor. They sat in the parser across multiple minor releases, which has two consequences for defenders.

First, an organisation that pinned NSD years ago for stability and has not moved since is not protected by that decision. Pinning protects you from new breakage; it does not protect you from old bugs that were only discovered now. The age of the installation is not a proxy for its safety.

Second, patch adoption in the field is probably clustered well behind the fixed release. Package maintainers need time, appliance vendors need more, and images baked into infrastructure-as-code templates can carry a release from the day they were built. The gap between an upstream fix and a fleet-wide upgrade is where exposure accumulates.

Building an inventory that answers this question

Teams that can name the NSD version on every node that parses zone files, and can say which of those nodes accept externally authored input, are ahead of teams that cannot. The second half is the harder half and the more valuable one. A node that only ever re-serves files the daemon produced from a trusted internal generator has a materially different risk profile from one that ingests customer uploads.

Software composition records help here. If NSD appears in a bill of materials with a version and a vulnerability feed, the discovery work becomes a query instead of an archaeology project. That is the practical answer to a range like 4.10.0 through 4.15.2: you cannot rely on recollection, so record it.

Exposure measured from outside

A ZoomEye query on 25 October 2026 for the NSD application fingerprint returned 116,266 assets, and 116,203 for the same fingerprint combined with port 53. The figure describes internet-visible services matching an NSD product fingerprint. It carries no version information, so it cannot be converted into a count of vulnerable hosts, and it does not reveal whether a host parses third-party zone files.

Remediation and the durable lesson

Upgrade to NSD 4.15.3 or newer; where a rebuild comes before a package, the vendor publishes a diff per CVE for application with patch -p1 and make install. Beyond this release, the lesson is cadence. Subscribe to the NSD advisory feed, treat version drift on authoritative servers as a tracked risk rather than a background fact, and pair every parser patch with a look at who can reach the parser. Neither step is glamorous, and both reduce the size of the next range an advisory has to describe.

References

Top comments (0)