NSD 4.15.3 patches four high-severity DNS parsing RCEs
Stack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
NLnet Labs has issued NSD 4.15.3 as a security release, fixing four high-severity remote code execution class stack overflows in the authoritative DNS server's resource-record parsers.
Willem Toorop, writing for the NSD team, said the flaws allow specially crafted RDATA to overwrite the stack. Operators running 4.15.2 should upgrade or apply the provided fixes.
CVE-2026-101337 is a stack overwrite triggered by a specially formatted base64 RDATA field. CVE-2026-101338 is a stack overwrite from a crafted SVCB or HTTPS record. CVE-2026-101339 is a stack overwrite from a crafted HIP record. CVE-2026-101341 is a stack overwrite from a specially formatted TXT-DATA RDATA field.
All four are rated high severity. Because NSD is commonly used as an authoritative nameserver, successful exploitation could compromise the host that answers DNS queries for a zone. The release ships individual and combined patches tested against 4.15.2.