DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

Four overflow bugs, one coding lesson: what NSD 4.15.3 says about parser hardening

#dns #nsd #vulnerability #cve2026101338

Four overflow bugs, one coding lesson: what NSD 4.15.3 says about parser hardening

Reading the NSD advisories side by side produces a lesson broader than the patch. Four separate CVEs in one release, all stack overwrites, all in zone-file parsing, all fixed in 4.15.3. The common thread is a parser that trusted a derived length. Any team maintaining software that consumes semi-trusted structured input can learn from the specific ways that trust failed.

The pattern in the four CVEs

CVE-2026-101341 is the clearest illustration. Text tokens shorter than 32 bytes were not checked against the space reserved for RDATA, so an arbitrarily sized out-of-bounds write became possible, and the advisory notes it can cover a callback function pointer used right after parsing.
CVE-2026-101337 is arithmetic drift. Base64 data split into pieces of three characters or less had token sizes computed as zero bytes, so the parser believed it needed no room while the decoder wrote up to 64 KB.
CVE-2026-101339 is a boundary that held for the record but not for the field appended to it. A HIP record filled near or at its RDATA limit, plus a rendezvous server, wrote 191 bytes past the stack buffer.
CVE-2026-101338 is an unbounded decode after a failed limit check. A SVCB or HTTPS record filled to the brim, an extra ECH parameter, and the base64 decoder writes data of unrestricted size.

Three properties that would have prevented all four

First, a single length authority. In each case the parser had two notions of size: the space reserved and the length derived from input. When code has one variable that both the allocation and the write consult, the disagreement disappears.
Second, bounded decoders. The base64 path in CVE-2026-101338 and CVE-2026-101337 wrote based on its own view of the data. A decoder that takes an explicit destination capacity turns an unbounded write into a rejection.
Third, checked pointer arithmetic before callback use. CVE-2026-101341 reached a callback function pointer because the overflow was not confined to a buffer that the parser merely read from. Placing callbacks and function tables outside writable parser memory reduces the value of a nearby overflow.

Why zone files deserve hostile-input treatment

Zone files look like configuration. Operators edit them by hand, scripts generate them, control panels render them. That appearance encourages parsers to treat the content as trusted. The advisories are explicit that files NSD writes itself avoid the problematic shapes, which is exactly the assumption that breaks when another system produces the file.
The same reasoning applies beyond DNS. Certificate signing requests, routing policy imports, mail filter rules, and package metadata all arrive as structured text that another program generated. Every one of those parsers has the same structural risk.

Testing that finds these bugs

Fuzzing remains the practical method. A harness that feeds structured records into the parser and varies lengths at field boundaries would reach CVE-2026-101341 and CVE-2026-101337 quickly, because both are length accounting errors near small thresholds. CVE-2026-101339 needs the harness to append a second field to a record already at its limit, and CVE-2026-101338 needs the harness to respect wire-format sizing so the overflow requires a plausible record rather than random bytes.
One addition to a fuzzing pipeline pays off here: assert on the invariant after every parse. If the parser exposes a count of bytes written, compare it against the bytes reserved and fail the test when they diverge. That turns a memory-safety bug into a clear assertion failure.

Affected scope and remediation

NSD 4.10.0 through 4.15.2 inclusive; earlier releases and 4.15.3 are not affected. SecurityOnline reports a CVSS v4 score of 8.7 for each CVE with no public exploit at publication.
Upgrade to NSD 4.15.3 from https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz. Backports can use the published diffs, for example https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101338.diff, applied with patch -p1 then make install. Verify the running binary afterwards, and use the fixed nsd-checkzone to review production zones.

Exposure context

ZoomEye can size the NSD population but not the vulnerable subset. app="NSD" returned 116,266 assets at the time of writing and banner="NSD" returned 628,831, while vul.cve="CVE-2026-101338" returned zero. No count indicates version or configuration.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOU0Qi

References

Top comments (0)