CVE-2026-101338: Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NSDto a version that resolves this vulnerability.Fixed in 4.15.3
Event History
Frequently Asked Questions
Which NSD deployments are realistically exposed?
Deployments that feed zone files directly to NSD are exposed if those files can contain specially formatted SVCB or HTTPS records. This can include zone content supplied through an operator-controlled provisioning system.
Are secondary zones written out by NSD affected?
No. Zone files written by NSD itself, including for zones where the NSD instance is secondary, are not formatted in the way required to trigger the issue.
What must an attacker control to exploit this?
The attacker needs to cause NSD to process a directly supplied zone file containing a SVCB or HTTPS RR whose wire-format RDATA is filled to the limit and includes another ECH parameter. The malformed record can then cause the base64 decoder to write attacker-controlled data beyond the stack limit.