CVE-2026-101339: CWE-121 Stack-based Buffer Overflow in NLnet Labs NSD

The vulnerability CVE-2026-101339 in NLnet Labs NSD is a stack-based buffer overflow (CWE-121) triggered by processing a HIP resource record that nearly fills the RDATA field and includes another dname RDATA field representing a HIP Rendezvous server. This can cause an overwrite of up to 191 bytes of attacker-controlled data on the stack. The issue arises only when NSD is fed zone files directly, for example from an operator-controlled provisioning system, rather than zone files written out by NSD itself. The affected versions are >=4.10.0 and <4.15.3. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required beyond local, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to overwrite the stack with controlled data, potentially leading to arbitrary code execution or denial of service. The vulnerability affects NSD instances that process crafted zone files directly, which could be used by an attacker with the ability to supply such zone files. There are no reports of active exploitation in the wild at this time.

No official patch or remediation details are provided in the available data. Users should monitor NLnet Labs advisories for updates and consider restricting or validating the source of zone files fed directly to NSD to prevent malicious input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.