Bug 2552145 (CVE-2026-101337)

Summary: CVE-2026-101337 nsd: NSD: Arbitrary code execution via crafted zone file parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NSD (Name Server Daemon). When parsing DNS zone files containing base64-encoded data formatted in segments of three characters or fewer, NSD incorrectly calculates token sizes, resulting in a stack-based buffer overflow. An attacker who can supply or manipulate a zone file loaded by the server could exploit this flaw to overwrite stack memory with controlled data, potentially achieving arbitrary code execution or causing a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2552148, 2552149    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-14 11:02:28 UTC 
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).