CVE-2026-101339: Stack overwrite from a specially crafted and formatted HIP RR
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NSDto a version that resolves this vulnerability.Fixed in 4.15.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
NSD instances that directly ingest operator-supplied or externally provisioned zone files containing HIP resource records are exposed. Secondary zones written out by NSD itself are not formatted in the affected way.
What must an attacker or malicious input source control to trigger it?
They need to supply a specially formatted HIP resource record whose RDATA fills near or at its limit and includes another domain-name RDATA field for a HIP Rendezvous server. The vulnerable zone file must be fed directly to NSD.
What can be done if patching is not immediately possible?
Do not directly load untrusted or insufficiently validated zone files into NSD, especially files supplied by provisioning systems. Restrict direct zone-file ingestion to trusted sources and review HIP records before deployment.
How can administrators determine whether their workflow is affected?
Review zone-file inputs that are fed directly to NSD for HIP resource records with near-limit RDATA and a HIP Rendezvous server domain-name field. Zones received as secondary data and written out by NSD itself are not described as affected.