Quick answers
- Is CVE-2026-101339 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101339 being exploited in the wild.
- How severe is CVE-2026-101339?
- Informational severity, published 14 October 2026.
- Which products and versions are affected?
- NLnet Labs NSD 4.10.0 through 4.15.2.
- Is there a fix for CVE-2026-101339?
- Yes: fixed in NSD 4.15.3. Until then: Upgrade to NSD 4.15.3 or apply the official patch manually. Restrict zone file provisioning to trusted sources and validate zone files before feeding them to NSD. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101339 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-101339?
- Check whether you run NLnet Labs NSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: NSD 4.15.3
Upgrade to NSD 4.15.3 or apply the official patch manually. Restrict zone file provisioning to trusted sources and validate zone files before feeding them to NSD.
Technical details
An out-of-bounds stack overwrite vulnerability exists when NSD parses a HIP resource record with RDATA near its size limit combined with a dname field (HIP Rendezvous server). An attacker can write up to 191 bytes of controlled data onto the stack, potentially leading to code execution. The attack requires a specially crafted zone file fed directly to NSD; zone files generated by NSD itself are not vulnerable.
Affected products
- NLnet Labs NSD 4.10.0 through 4.15.2
Timeline
- 2026-10-14: disclosed