Source: nsd Version: 4.15.2-1 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream fixed-upstream
Hi, The following vulnerabilities were published for nsd. CVE-2026-101337[0]: | When base64 data is split up in pieces, of 3 character or less, | tokens were incorrectly calculated to produce 0 bytes. This enables | attackers to overwrite the stack with up to 64K of attacker | controlled data. Zone files which are written out by NSD itself, | such as for zones for which the NSD instance is secondary, will not | be formatted like this. The zone file must be fed to NSD directly, | (but it could come, for example, from an operator controlled | provisioning system). CVE-2026-101338[1]: | When a SVCB or HTTPS RR has filled the wire format RDATA up to the | brim, another ECH parameter may overwrite the stack, and once beyond | the limit, the base64 decoder can write attacker controlled data of | unlimited size. Zone files which are written out by NSD itself, | such as for zones for which the NSD instance is secondary, will not | be formatted like this. The zone file must be fed to NSD directly, | (but it could come, for example, from an operator controlled | provisioning system). CVE-2026-101339[2]: | A HIP resource record that fills the RDATA near or at is limit, and | has another dname RDATA field (a HIP Rendezvous server) can | overwrite the stack with up to 191 bytes of attacker controlled | data. Zone files which are written out by NSD itself, such as for | zones for which the NSD instance is secondary, will not be formatted | like this. The zone file must be fed to NSD directly, (but it could | come, for example, from an operator controlled provisioning system). CVE-2026-101341[3]: | Tokens of text in RDATA (of for example TXT records) under 32 bytes | are not checked to stay within the space reserved for the RDATA | allowing for arbitrary sized out of bound stack writes, including an | overwrite of a callback function pointer which is called directly | after parse. Zone files which are written out by NSD itself, such | for zones for which the NSD instance is secondary, will not be | formatted like this. The zone file must be fed to NSD directly, (but | it could come, for example, from an operator controlled provisioning | system). If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-101337 https://www.cve.org/CVERecord?id=CVE-2026-101337 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt [1] https://security-tracker.debian.org/tracker/CVE-2026-101338 https://www.cve.org/CVERecord?id=CVE-2026-101338 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt [2] https://security-tracker.debian.org/tracker/CVE-2026-101339 https://www.cve.org/CVERecord?id=CVE-2026-101339 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt [3] https://security-tracker.debian.org/tracker/CVE-2026-101341 https://www.cve.org/CVERecord?id=CVE-2026-101341 https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt Please adjust the affected versions in the BTS as needed. Regards, Salvatore
