Nlnet Labs Nsd vulnerabilities

4 CVEs affecting Nlnet Labs Nsd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-101341, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-101341, published 2026-10-14. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including…
CVE-2026-101339, published 2026-10-14. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. …
CVE-2026-101338, published 2026-10-14. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled…
CVE-2026-101337, published 2026-10-14. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker…