NLnet Labs NSD CVE-2026-101339

Requires a crafted HIP (Host Identity Protocol) resource record whose RDATA is at or near its size limit AND which carries a second dname RDATA field (a HIP Rendezvous server), delivered inside a zone file that is loaded directly by NSD. Critically, the attacker must control zone-file content reaching NSD - e.g. via an operator-controlled provisioning or automation pipeline. Exploitation is LIMITED by the fact that zones NSD writes out itself (such as secondary zones obtained via zone transfer) are not formatted in the vulnerable manner and are therefore not affected, and the flaw is not reachable through ordinary DNS query traffic; it is a zone-file parsing bug, not a wire-protocol bug.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) and score of 8.7 (High) overstate the practical remote risk: the description explicitly states the malicious HIP record must arrive in a zone file 'fed to NSD directly,' and that zones NSD writes itself (e.g. secondary zones received via AXFR/IXFR) are NOT formatted in the vulnerable way. This means the realistic attack surface is operator- or provisioning-controlled zone content, not arbitrary network traffic or DNS queries - the AV:N labeling conflicts with the stated prerequisite of direct zone-file ingestion, which is closer to a local/config-dependent vector (verify intended vector with NLnet Labs). No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The technical impact is high (stack overflow with up to 191 bytes of attacker-controlled data over the NSD process), but the required control over zone-file input makes this a targeted, insider- or supply-chain-flavored risk rather than a broadly wormable internet-facing bug. Net: a genuine code-execution flaw worth patching promptly for operators whose zone data crosses trust boundaries, but materially lower real-world urgency than the 8.7 headline suggests given the privileged input prerequisite and absence of exploitation signals.

An attacker who can influence zone-file content - for example by injecting records through an operator-facing provisioning or automation system - crafts a HIP resource record whose RDATA is near its size limit and includes a second dname field (a HIP Rendezvous server). When that zone file is loaded directly by NSD, parsing overflows the stack by up to 191 bytes of attacker-controlled data, potentially leading to code execution in the NSD process. No public exploit code was identified in the provided data.