DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

Should You Worry About CVE-2026-101339? A Decision Guide for NSD Operators

#vulnerability #dns #nsd

Should You Worry About CVE-2026-101339? A Decision Guide for NSD Operators

Security advisories rarely say when to relax. This one does, in a sentence most readers skip. The NSD stack overwrite tracked as CVE-2026-101339 requires a zone file fed directly to the server; files NSD generates itself, including for secondary zones, are not formatted in the way that triggers it. That single constraint decides which operators need to act today and which can schedule the upgrade normally.

The short version

NLnet Labs released NSD 4.15.3 on 14 October 2026, closing four stack overwrite flaws in the zone file parser. All four affect 4.10.0 through 4.15.2, all are rated CVSS v4.0 8.7, and none have reported in-the-wild exploitation or public exploit code.

CVE-2026-101339 itself is a HIP resource record bug. Fill the RDATA near its limit, add a Rendezvous server dname, and the parser writes up to 191 bytes of attacker-controlled data past the stack boundary. The vendor's stated impact is possible arbitrary command execution.

Am I in the directly affected group?

Ask one question: does anything other than NSD write zone files this server parses?

If the answer is no, and every zone on the instance arrives through a transfer from a primary, the advisory's precondition does not apply to normal operation. Upgrade on your standard cadence and note the constraint in the record.

If the answer is yes, the instance is in the direct risk set. Provisioning systems, orchestration scripts, customer record portals, partner feeds, and version-controlled zone repositories all qualify. So does any workflow where a lower-privileged account can write into the zone directory.

The answer rarely appears in the network diagram; it comes from the deployment pipeline.

The three related bugs

CVE-2026-101341 covers string-sequence records including TXT, NINFO, SPF, AVC, RESINFO and WALLET. Tokens under 32 bytes are not checked against the RDATA reservation, allowing an out-of-bounds write that can overwrite a callback function pointer called immediately after parsing.

CVE-2026-101338 uses SVCB or HTTPS records. With the wire-format RDATA filled to capacity, an extra ECH parameter pushes the parser past the limit, and the base64 decoder writes attacker data of unlimited size.

CVE-2026-101337 involves base64 data split into chunks of three characters or fewer, which the parser miscomputes as a zero-byte token, permitting up to 64 KB of stack overwrite.

Because all four ship in one release and share a precondition, treat them as one change.

What the exposure data can and cannot tell you

A ZoomEye product query for app="NSD" returned 116,266 assets at 2026-10-25T20:15:54Z. It counts internet-visible NSD fingerprints.

It cannot see which instances load external zone files, which is the attribute that actually decides risk here. It also cannot see version. A CVE-level query for CVE-2026-101341 returned zero, a reminder that identifier indexes lag a fresh advisory.

Use the number to find NSD instances you did not know were reachable from the internet, then classify each by ingestion path from your own records.

Applying the upgrade

NSD 4.15.3 is published as a tarball by NLnet Labs. Where packaging holds you at 4.15.2, each advisory provides a diff applied from the source directory with patch -p1 < patch_CVE-2026-101339.diff and followed by make install. Apply all four, not just the one you read about first.

Restart the daemon afterwards and verify the running version. The parser lives inside the process, so an updated binary on disk has no effect until the service reloads.

Between patching and the next review cycle, restrict write access to the zone directory. A provisioning account that can only touch its own zone files limits the consequences of a malicious record arriving through a compromised feed.

The decision, stated plainly

If your NSD instances only serve transferred zones, this is a routine upgrade. If they parse files written by anything else, it is a same-week change and a pipeline review. The advisories do not exaggerate either way, and that clarity is worth passing to whoever owns the maintenance window.

References

Top comments (0)