EUVD-2026-100984
GHSA-v69q-gc77-qcjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInject crafted record into provisioning system
-
DeliveryZone file loaded directly by NSD
-
ExploitParse malicious HIP RDATA with dname
-
ExecutionOverflow stack with 191 bytes
-
ImpactExecute code as NSD process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a crafted HIP (Host Identity Protocol) resource record whose RDATA is at or near its size limit AND which carries a second dname RDATA field (a HIP Rendezvous server), delivered inside a zone file that is loaded directly by NSD. Critically, the attacker must control zone-file content reaching NSD - e.g. via an operator-controlled provisioning or automation pipeline. Exploitation is LIMITED by the fact that zones NSD writes out itself (such as secondary zones obtained via zone transfer) are not formatted in the vulnerable manner and are therefore not affected, and the flaw is not reachable through ordinary DNS query traffic; it is a zone-file parsing bug, not a wire-protocol bug. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) and score of 8.7 (High) overstate the practical remote risk: the description explicitly states the malicious HIP record must arrive in a zone file 'fed to NSD directly,' and that zones NSD writes itself (e.g. secondary zones received via AXFR/IXFR) are NOT formatted in the vulnerable way. This means the realistic attack surface is operator- or provisioning-controlled zone content, not arbitrary network traffic or DNS queries - the AV:N labeling conflicts with the stated prerequisite of direct zone-file ingestion, which is closer to a local/config-dependent vector (verify intended vector with NLnet Labs). No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The technical impact is high (stack overflow with up to 191 bytes of attacker-controlled data over the NSD process), but the required control over zone-file input makes this a targeted, insider- or supply-chain-flavored risk rather than a broadly wormable internet-facing bug. Net: a genuine code-execution flaw worth patching promptly for operators whose zone data crosses trust boundaries, but materially lower real-world urgency than the 8.7 headline suggests given the privileged input prerequisite and absence of exploitation signals. |
| Exploit ScenarioDerived | An attacker who can influence zone-file content - for example by injecting records through an operator-facing provisioning or automation system - crafts a HIP resource record whose RDATA is near its size limit and includes a second dname field (a HIP Rendezvous server). When that zone file is loaded directly by NSD, parsing overflows the stack by up to 191 bytes of attacker-controlled data, potentially leading to code execution in the NSD process. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.
RemediationAI
No vendor-released patch is confirmed in the provided intelligence; consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt for the fixed NSD release and apply it as the primary remediation once published. Until then, the most effective control follows directly from the assessed prerequisite: treat zone files as trusted input and lock down write access to the zone-file store and provisioning pipeline so that only the DNS operator's automation account can author zone content - this removes the low-privileged foothold (PR:L) the exploit requires and therefore neutralizes the flaw, at the cost of tighter operational access management. Where possible, obtain zones via AXFR/IXFR from a trusted primary and let NSD write them itself, since self-written secondary zones are not formatted in the vulnerable way; the trade-off is dependence on the primary and on zone-transfer availability. If HIP records are not in use, strip or reject HIP RRs - and in particular HIP records carrying Rendezvous-server dnames with RDATA near the size limit - in a pre-load validation step or zone linter before handing files to the daemon, accepting the added pipeline complexity and the risk of breaking legitimate HIP zones. Run NSD as an unprivileged user with stack-protector and ASLR enabled to reduce the impact of a successful overflow, recognizing that these only mitigate post-exploitation effects rather than prevent the corruption. Note that network-layer controls such as firewalling port 53 or query ACLs are irrelevant here, because the vulnerability is not reachable through DNS query traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NSD is an authoritative-only DNS name server from NLnet Labs that, in addition to serving queries, can read master zone files directly from disk and parse them into its in-memory zone database. The vulnerable code path is the zone-file parser for the HIP (Host Identity Protocol) RR, defined in RFC 8005 as type 55, whose RDATA carries a HIT, a public-key algorithm and key, and an optional list of Rendezvous server domain names (dname fields). When a HIP record's RDATA is at or near its maximum size and a second dname RDATA field follows, the parser's copy/offset arithmetic for that dname is not adequately bounds-checked, producing a classic CWE-121 stack-based buffer overflow that can place up to 191 bytes of attacker-controlled data past the end of a stack buffer. Because the flaw is confined to the zone-file ingestion path rather than the wire-protocol message parser, it is not triggerable by malformed DNS packets or by queries; it only manifests when a maliciously formatted zone file is handed to NSD directly. The supplied CPE is a wildcard for nlnet_labs:nsd (cpe:2.3:a:nlnet_labs:nsd:*:*:*:*:*:*:*:*), i.e. no fixed version was pinned in the intelligence feed, so every deployed NSD release should be presumed affected pending the vendor advisory. The associated tags (Buffer Overflow, Stack Overflow, NSD, NLnet Labs) align with CWE-121 and confirm this is a memory-safety defect in the daemon's provisioning/zone-load path.
Know when Nsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation requires supplying a crafted zone file directly to NSD rather than network query traffic, so AV:L and PR:L; successful stack overflow yields full code execution, giving C/I/A:H.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Executive ViewAI
NLnet Labs NSD contains a high-severity stack buffer overflow in zone-file parsing that can allow an attacker who controls zone-file content to execute code or crash the name server. This affects organizations that feed crafted zone files into NSD through operator-controlled provisioning or automation pipelines; ordinary DNS query traffic and zone transfers are not vulnerable, and no public exploit code has been identified at the time of analysis. Because no vendor patch is available and DNS is critical infrastructure, leadership should prioritize restricting zone-file write access and monitoring for unusual zone-file ingestion until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict zone-file write access to trusted operators; disable or tightly control automated zone-file ingestion pipelines; pre-validate and reject HIP RRs with oversized RDATA or unexpected second dname fields; run NSD with least privilege and in an isolated segment; enable file integrity monitoring and crash/alert monitoring on NSD hosts. Note that the vulnerability is not reachable via ordinary DNS query traffic or zone transfers, so network filtering for DNS queries is not an effective mitigation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a c
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supp
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data spl
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a k
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
Exploit-DB