PT-2026-113785
CVE-2026-101338
·
Published
2026-10-14
·
Updated
2026-11-03
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
NSD (affected versions not specified)
Description
An issue exists where a SVCB or HTTPS Resource Record (RR) that fills the wire format RDATA to capacity can allow an ECH parameter to overwrite the stack. Once the limit is exceeded, the base64 decoder can write attacker-controlled data of unlimited size. This occurs when zone files are fed directly to NSD, such as those coming from an operator-controlled provisioning system, rather than files written by NSD itself.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾