Bug 2552142 (CVE-2026-101338)

Summary: CVE-2026-101338 nsd: nsd: arbitrary code execution via crafted zone file records
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NSD. When processing zone files containing specially formatted Service Binding (SVCB) or HTTPS resource records, the base64 decoding routine can exceed memory limits and cause a stack-based buffer overflow. An attacker capable of provisioning or supplying crafted zone files directly to the server could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2552150, 2552154    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-14 11:01:45 UTC 
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).