CVE-2026-101339 NLnet Labs CVE debrief

Who should care

Defenders responsible for NSD configurations and zone file management should assess exposure and prioritize verification of their systems, especially those with secondary zones. They should also monitor for suspicious zone file updates and review compensating controls for exposed systems.

Why it matters

CVE-2026-101339 is a high-severity vulnerability in NLnet Labs' NSD that can cause a stack overwrite, allowing an attacker to overwrite up to 191 bytes of stack data. Defenders should prioritize verifying NSD configurations, especially those with secondary zones, and monitor for suspicious zone file updates.

• Verify NSD configurations for potential exposure
• Monitor for suspicious zone file updates
• Update NSD to version 4.15.3 or later

Technical summary

The vulnerability occurs when a specially crafted HIP resource record is fed to NSD, potentially overwriting up to 191 bytes of stack data. This requires a malicious zone file to be directly provided to NSD, possibly through an operator-controlled provisioning system. The issue has a CVSS score of 8.7 and is considered high severity. Defenders should prioritize verifying NSD configurations, especially those with secondary zones, and monitor for suspicious zone file updates. NSD zone files written by the NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this.

Defensive priority

Defenders should prioritize verifying NSD configurations, especially those with secondary zones, and monitor for suspicious zone file updates.

Recommended defensive actions

• Verify NSD configurations and zone files for suspicious updates
• Monitor NSD logs for potential exploitation attempts
• Update NSD to version 4.15.3 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score and affected versions. However, additional information on exploitation or victim impact is not available. Defenders should verify NSD configurations, especially those with secondary zones, and monitor for suspicious zone file updates. The CVE Program and NVD provide official records and assessments of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.