The CVE number for this vulnerability is CVE-2026-101338

= Summary
When reading zone files, a specially crafted and format SVCB or HTTPS record
cancause an out of bounds stack overwrite which can be exploited for execution
of arbitrary commands.


== Affected products
NSD from and including version 4.10.0 up to and including version 4.15.2


== Description
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim,
another ECH parameter may overwrite the stack, and once beyond the limit, the
base64 decoder can write attacker controlled data of unlimited size.

Zone files which are written out by NSD itself, such as for zones for which the
NSD instance is secondary, will not be formatted like this. The zone file must
be fed to NSD directly, (but it could come, for example, from an operator
controlled provisioning system).


== Mitigation

=== Downloading patched version
NSD 4.15.3 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz

=== Applying the patch manually
For NSD 4.15.2 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101338.diff

Apply the patch on the NSD source directory with:
    patch -p1 < patch_CVE-2026-101338.diff
then run 'make install' to install NSD.

The patch is tested to work on NSD 4.15.2.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, for discovering and
responsibly disclosing the vulnerability.