CVE Feed

    Dashboard / CVE / CVE-2026-101341

    CVE-2026-101341

    Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

    Published:Oct 14, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00335
    CVSS Score:8.7

    Affected Products

    Vendor
    Nlnetlabs
    Product
    Nsd

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-121 Stack-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-101339 (CVSS 8.7) — A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rende…
    CVE-2026-101338 (CVSS 8.7) — When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite t…
    CVE-2026-101337 (CVSS 8.7) — When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce …
    CVE-2026-19538 (CVSS 8.2) — The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be …
    CVE-2026-19401 (CVSS 8.2) — Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special craft…
    CVE-2026-18916 (CVSS 6.9) — Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By cont…
    CVE-2026-18664 (CVSS 8.2) — When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the …
    CVE-2026-12490 (CVSS 8.2) — When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client ce…
    CVE-2026-12246 (CVSS 7.2) — NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted …
    CVE-2026-12245 (CVSS 8.7) — NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-101341 — Nlnetlabs (High 8.7) | CVE-DB