The CVE number for this vulnerability is CVE-2026-101337

= Summary
When reading zone files, a resource record with a base64 RDATA field in a
specially crafted presentation format, can cause an out of bounds stack
overwrite which can be exploited for execution of arbitrary command.


== Affected products
NSD from and including version 4.10.0 up to and including version 4.15.2


== Description
When base64 data is split up in pieces, of 3 character or less, tokens were
incorrectly calculated to produce 0 bytes. This enables attackers to overwrite
the stack with up to 64K of attacker controlled data.

Zone files which are written out by NSD itself, such as for zones for which the
NSD instance is secondary, will not be formatted like this. The zone file must
be fed to NSD directly, (but it could come, for example, from an operator
controlled provisioning system).


== Mitigation

=== Downloading patched version
NSD 4.15.3 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz

=== Applying the patch manually
For NSD 4.15.2 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101337.diff

Apply the patch on the NSD source directory with:
    patch -p1 < patch_CVE-2026-101337.diff
then run 'make install' to install NSD.

The patch is tested to work on NSD 4.15.2.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks, and Gaurang Maheta
for discovering and responsibly disclosing the vulnerability.