CVE-2026-101337

Awaiting Analysis Awaiting Analysis - Queue

Base64 Token Calculation Flaw in NSD Stack Overflow

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: NLnet Labs

Description

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101337

EUVD

EUVD-2026-100982

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet	Labs	NSD 4.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in how NSD processes base64-encoded data in zone files. When base64 data is split into chunks of three characters or less, NSD incorrectly calculates tokens, leading to zero-byte production. This allows attackers to overwrite up to 64KB of stack memory with their own data, potentially enabling arbitrary command execution.

Detection Guidance

Check if your NSD version is between 4.10.0 and 4.15.2 by running 'nsd --version'. Inspect zone files for base64 RDATA fields split into 3-character or smaller chunks. Monitor for unexpected stack behavior or crashes during zone file processing.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary commands on systems running vulnerable NSD versions. This could lead to full system compromise, unauthorized access, or data theft. Attackers need to provide a specially crafted zone file to trigger the issue.

Compliance Impact

This vulnerability allows attackers to overwrite the stack with up to 64KB of controlled data, which could lead to arbitrary command execution. Such unauthorized access may result in data breaches, unauthorized data access, or manipulation, directly impacting compliance with GDPR (data protection) and HIPAA (health data security) by exposing sensitive information.

Mitigation Strategies

Upgrade NSD to version 4.15.3 immediately. If upgrading is not possible, manually apply the patch from the NSD website to NSD 4.15.2 and reinstall. Avoid feeding malformed zone files directly into NSD.

Hi! I’m here to help you understand CVE-2026-101337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70