NLNET Labs has patched four high-severity NSD stack overwrite vulnerabilities with the release of NSD version 4.15.3 on 14 October 2026. The flaws enable an attacker to trigger remote code execution by supplying specially crafted zone files, affecting primary DNS servers that parse untrusted zone data. The four CVEs are CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, and CVE-2026-101337.
The issues arise from improper boundary checks during zone file parsing, allowing out-of-bounds writes to overwrite control data on the stack. Affected records span TXT, NINFO, SPF, and related fields (CVE-2026-101341); HIP records (CVE-2026-101339); SVCB/HTTPS records (CVE-2026-101338); and base64 RDATA formatting (CVE-2026-101337). In all cases, the payload can be supplied via zone data and may enable remote code execution on vulnerable NSD instances.
Affected versions run from 4.10.0 through 4.15.2; versions prior to 4.10.0 and the fixed 4.15.3 or newer are not affected. NLnet Labs’ patch is available in 4.15.3, with a patch-or-compile workaround suggested for those unable to upgrade immediately. Administrators are advised to upgrade promptly or apply the vendor-supplied diffs, and to audit provisioning pipelines to reject untrusted zone files before parsing. There is no public proof-of-concept, and no active exploitation has been confirmed to date.