Your message dated Thu, 15 Oct 2026 06:31:09 +0200
with message-id <[email protected]>
and subject line Re: Accepted nsd 4.15.3-1 (source) into unstable
has caused the Debian Bug report #1150930,
regarding nsd: CVE-2026-101337 CVE-2026-101338 CVE-2026-101339 CVE-2026-101341
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150930: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150930
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: nsd
Version: 4.15.2-1
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream fixed-upstream
Hi,
The following vulnerabilities were published for nsd.
CVE-2026-101337[0]:
| When base64 data is split up in pieces, of 3 character or less,
| tokens were incorrectly calculated to produce 0 bytes. This enables
| attackers to overwrite the stack with up to 64K of attacker
| controlled data. Zone files which are written out by NSD itself,
| such as for zones for which the NSD instance is secondary, will not
| be formatted like this. The zone file must be fed to NSD directly,
| (but it could come, for example, from an operator controlled
| provisioning system).
CVE-2026-101338[1]:
| When a SVCB or HTTPS RR has filled the wire format RDATA up to the
| brim, another ECH parameter may overwrite the stack, and once beyond
| the limit, the base64 decoder can write attacker controlled data of
| unlimited size. Zone files which are written out by NSD itself,
| such as for zones for which the NSD instance is secondary, will not
| be formatted like this. The zone file must be fed to NSD directly,
| (but it could come, for example, from an operator controlled
| provisioning system).
CVE-2026-101339[2]:
| A HIP resource record that fills the RDATA near or at is limit, and
| has another dname RDATA field (a HIP Rendezvous server) can
| overwrite the stack with up to 191 bytes of attacker controlled
| data. Zone files which are written out by NSD itself, such as for
| zones for which the NSD instance is secondary, will not be formatted
| like this. The zone file must be fed to NSD directly, (but it could
| come, for example, from an operator controlled provisioning system).
CVE-2026-101341[3]:
| Tokens of text in RDATA (of for example TXT records) under 32 bytes
| are not checked to stay within the space reserved for the RDATA
| allowing for arbitrary sized out of bound stack writes, including an
| overwrite of a callback function pointer which is called directly
| after parse. Zone files which are written out by NSD itself, such
| for zones for which the NSD instance is secondary, will not be
| formatted like this. The zone file must be fed to NSD directly, (but
| it could come, for example, from an operator controlled provisioning
| system).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-101337
https://www.cve.org/CVERecord?id=CVE-2026-101337
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt
[1] https://security-tracker.debian.org/tracker/CVE-2026-101338
https://www.cve.org/CVERecord?id=CVE-2026-101338
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt
[2] https://security-tracker.debian.org/tracker/CVE-2026-101339
https://www.cve.org/CVERecord?id=CVE-2026-101339
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt
[3] https://security-tracker.debian.org/tracker/CVE-2026-101341
https://www.cve.org/CVERecord?id=CVE-2026-101341
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: nsd
Source-Version: 4.15.3-1
Hi Simon,
On Wed, Oct 14, 2026 at 10:11:58PM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Wed, 14 Oct 2026 21:41:55 +0200
> Source: nsd
> Architecture: source
> Version: 4.15.3-1
> Distribution: unstable
> Urgency: medium
> Maintainer: nsd packagers <[email protected]>
> Changed-By: Simon Josefsson <[email protected]>
> Changes:
> nsd (4.15.3-1) unstable; urgency=medium
> .
> * New upstream version 4.15.3
> - CVE-2026-101341
> - CVE-2026-101339
> - CVE-2026-101338
> - CVE-2026-101337
Looks we had a race :). Closing #1150930, thanks for the quick upload!
Regards,
Salvatore
--- End Message ---
