NLnet Labs NSD CVE-2026-101338

Exploitation requires that a crafted zone file containing a SVCB or HTTPS resource record - with RDATA filled to the wire-format limit followed by an ECH parameter - be fed directly to NSD for parsing. The attacker must therefore control or inject into the zone-provisioning path (e.g. an operator-controlled provisioning system or a multi-tenant zone-submission pipeline). Key LIMITING factor explicitly stated by the vendor: zone files written out by NSD itself, such as secondary zones received via AXFR/IXFR, are NOT formatted this way and cannot trigger the flaw - so normal remote DNS queries and standard secondary-zone operation are not an exploitation surface. This is a data/trust-boundary dependent flaw, not unauthenticated remote exploitation.

This is a stack-based buffer overflow (CWE-121) in NSD's parsing of SVCB/HTTPS resource records: an oversized ECH parameter overflows the stack and the base64 decoder then writes attacker-controlled data of unlimited size, a classic path to arbitrary code execution. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.7 with full High confidentiality, integrity and availability impact, consistent with memory-corruption-to-RCE. However, the real-world risk is materially lower than the raw 8.7 suggests because exploitation is gated by a significant precondition: the malicious SVCB/HTTPS record must arrive in a zone file fed directly to NSD, and NSD-generated zone files (e.g. secondary/AXFR-received zones) are NOT formatted in the vulnerable way, so a remote DNS query alone cannot trigger it. This means an attacker needs control over, or the ability to inject content into, the zone-provisioning pipeline - justifying PR:L rather than PR:N. No EPSS score, CISA KEV listing, or public POC is present in the provided data (no public exploit identified at time of analysis), and the only source is the NLnet Labs vendor advisory. Note a tension between the AV:N label and the description's emphasis on operator-fed zone files: the network vector is really the provisioning path, not an unauthenticated query surface - verify the intended trust model with the vendor advisory. Overall: a genuine high-severity RCE for operators of provisioning systems that ingest untrusted/multi-tenant zone data, but not a mass-exploitable remote DNS vulnerability.

An attacker able to submit zone content through an operator-controlled provisioning system (for example a hosting tenant or an upstream data source feeding NSD directly) crafts a zone with a SVCB or HTTPS RR whose RDATA is filled to the wire-format limit followed by an ECH parameter. When NSD parses this zone file, the base64 decoder writes attacker-controlled data past the stack buffer, corrupting the stack and enabling arbitrary code execution in the NSD process. No public exploit code is identified at time of analysis, and triggering requires the record to reach NSD via a directly-fed zone file rather than normal DNS traffic.