Executive brief
NLnet Labs NSD, a widely used authoritative DNS name server, contains a flaw in how it handles specific DNS records. An attacker with the ability to provide zone data (such as a malicious primary server in a multi-tenant environment) can cause the secondary server to crash or potentially execute unauthorized code. This could lead to a total loss of service availability or unauthorized modifications to DNS data.
Technical details
A stack-based buffer overflow (CWE-120) exists in NSD versions 4.14.0 through 4.14.2. The vulnerability is triggered when an APL Resource Record (RR) contains an 'adflength' value larger than what is permitted for its address family. When NSD attempts to write the zone to disk, this improper validation leads to an out-of-bounds write on the stack of up to 111 attacker-controlled bytes. While the data typically originates from a trusted primary server, this poses a significant risk in multi-tenant secondary DNS deployments where a primary server may be compromised or malicious. The issue is fixed in NSD version 4.14.3.
Affected products
- NLnet Labs NSD 4.14.0 - 4.14.2
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched: Fixed in version 4.14.3