Hi,
The following vulnerabilities were published for nsd.
CVE-2026-101337[0]:
| When base64 data is split up in pieces, of 3 character or less,
| tokens were incorrectly calculated to produce 0 bytes. This enables
| attackers to overwrite the stack with up to 64K of attacker
| controlled data. Zone files which are written out by NSD itself,
| such as for zones for which the NSD instance is secondary, will not
| be formatted like this. The zone file must be fed to NSD directly,
| (but it could come, for example, from an operator controlled
| provisioning system).
CVE-2026-101338[1]:
| When a SVCB or HTTPS RR has filled the wire format RDATA up to the
| brim, another ECH parameter may overwrite the stack, and once beyond
| the limit, the base64 decoder can write attacker controlled data of
| unlimited size. Zone files which are written out by NSD itself,
| such as for zones for which the NSD instance is secondary, will not
| be formatted like this. The zone file must be fed to NSD directly,
| (but it could come, for example, from an operator controlled
| provisioning system).
CVE-2026-101339[2]:
| A HIP resource record that fills the RDATA near or at is limit, and
| has another dname RDATA field (a HIP Rendezvous server) can
| overwrite the stack with up to 191 bytes of attacker controlled
| data. Zone files which are written out by NSD itself, such as for
| zones for which the NSD instance is secondary, will not be formatted
| like this. The zone file must be fed to NSD directly, (but it could
| come, for example, from an operator controlled provisioning system).
CVE-2026-101341[3]:
| Tokens of text in RDATA (of for example TXT records) under 32 bytes
| are not checked to stay within the space reserved for the RDATA
| allowing for arbitrary sized out of bound stack writes, including an
| overwrite of a callback function pointer which is called directly
| after parse. Zone files which are written out by NSD itself, such
| for zones for which the NSD instance is secondary, will not be
| formatted like this. The zone file must be fed to NSD directly, (but
| it could come, for example, from an operator controlled provisioning
| system).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-101337
https://www.cve.org/CVERecord?id=CVE-2026-101337
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt
[1] https://security-tracker.debian.org/tracker/CVE-2026-101338
https://www.cve.org/CVERecord?id=CVE-2026-101338
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt
[2] https://security-tracker.debian.org/tracker/CVE-2026-101339
https://www.cve.org/CVERecord?id=CVE-2026-101339
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt
[3] https://security-tracker.debian.org/tracker/CVE-2026-101341
https://www.cve.org/CVERecord?id=CVE-2026-101341
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore