# CVE-2026-101337: NSD stack buffer overflow in base64 RDATA parsing

Source: https://junglewise.ai/threats/cve-2026-101337-when-base64-data-is-split-up-in-pieces-of-3-character-or-less  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-101337 · Severity: info · Published 2026-10-14

NSD is an authoritative DNS nameserver that processes zone files containing DNS records. A specially crafted zone file with malformed base64 data in resource records can cause NSD to write up to 64KB of attacker-controlled data onto the stack, potentially allowing remote code execution. The vulnerability requires an operator to feed a malicious zone file to NSD, such as through a provisioning system.

Technologies: [NLnet Labs NSD](https://junglewise.ai/threats/technologies/nlnet-labs-nsd). Vendors: [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-101337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101337 being exploited in the wild.

**How severe is CVE-2026-101337?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** NLnet Labs NSD 4.10.0 to 4.15.2.

**Is there a fix for CVE-2026-101337?** Yes: fixed in NSD 4.15.3. Until then: Upgrade to NSD 4.15.3 or apply the patch from https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101337.diff to NSD 4.15.2. Restrict zone file provisioning to trusted sources only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101337 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-101337?** Check whether you run NLnet Labs NSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in NSD 4.15.3

Upgrade to NSD 4.15.3 or apply the patch from https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101337.diff to NSD 4.15.2. Restrict zone file provisioning to trusted sources only.

## Technical details

An integer calculation error occurs when parsing base64-encoded RDATA fields that are split into pieces of 3 characters or less, causing the decoder to write 0 bytes and leading to an out-of-bounds stack buffer overwrite. The attack requires direct input of a crafted zone file to the NSD daemon. NSD 4.15.3 and a patch for 4.15.2 are available to fix this issue.

## Affected products

- NLnet Labs NSD 4.10.0 to 4.15.2

## Timeline

- 2026-10-14: disclosed

## References

- [https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt](https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt)

## Related threats

- [NSD stack buffer overflow in RDATA parsing](https://junglewise.ai/threats/cve-2026-101341-tokens-of-text-in-rdata-of-for-example-txt-records-under-32)
- [NSD stack overflow in HIP resource record parsing](https://junglewise.ai/threats/cve-2026-101339-a-hip-resource-record-that-fills-the-rdata-near-or-at-is-limit)
- [NSD stack buffer overflow in SVCB/HTTPS record parsing](https://junglewise.ai/threats/cve-2026-101338-when-a-svcb-or-https-rr-has-filled-the-wire-format-rdata-up-to)