CVE-2026-101337: Stack overwrite from specially formatted base64 RDATA field
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NSDto a version that resolves this vulnerability.Fixed in 4.15.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
NSD instances that directly ingest zone files from a provisioning system or another source capable of supplying specially formatted base64 RDATA are exposed. Secondary zones written out by NSD itself are not formatted in the affected way.
What does an attacker need to exploit it?
An attacker needs a way to feed NSD a zone file containing base64 data split into pieces of three characters or fewer. The malformed token calculation can then enable a stack overwrite with up to 64K of attacker-controlled data.
What can be done if patching is not immediately possible?
Avoid directly feeding NSD zone files from untrusted or insufficiently controlled sources. Validate or reject base64 RDATA that is split into chunks of three characters or fewer before NSD processes the zone file.