CVE-2026-101338: CWE-121 Stack-based Buffer Overflow in NLnet Labs NSD

This vulnerability (CWE-121) in NLnet Labs NSD arises when SVCB or HTTPS RRs have wire format RDATA fully utilized, and an extra ECH parameter causes a stack overflow. The overflow enables the base64 decoder to write arbitrary data beyond the buffer limit, potentially leading to memory corruption. The issue specifically affects zone files fed directly to NSD, not those written by NSD itself. The affected versions are >=4.10.0 and <4.15.3. The CVSS 4.0 score is 8.7 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to a stack-based buffer overflow allowing an attacker to overwrite memory with attacker-controlled data of unlimited size. This can result in memory corruption, potentially enabling arbitrary code execution or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected NSD service.

No patch links or vendor advisory content are provided in the input data. Patch status is not yet confirmed — check the NLnet Labs vendor advisory for current remediation guidance. Until a patch is available, avoid feeding zone files directly to NSD from untrusted or operator-controlled provisioning systems that could include maliciously crafted SVCB or HTTPS RRs with ECH parameters.