---
id: CVE-2026-101339
title: >-
  A HIP resource record that fills the RDATA near or at is limit, and has
  another dname RDATA field (a HIP Rendezvous server) can overwrite the stack
  with up to 191 bytes of attacker controlled data
summary: >-
  A HIP resource record that fills the RDATA near or at is limit, and has
  another dname RDATA field (a HIP Rendezvous server) can overwrite the stack
  with up to 191 bytes of attacker controlled data.  Zone files which are
  written out by NS…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-121
vendor: NLnet Labs
product: NSD
affected:
  - NSD >= 4.10.0 < 4.15.3
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:55:59.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101339'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt'
    label: sep@nlnetlabs.nl
tags:
  - nvd
  - cve.org
epss: 0.0034
epssPercentile: 0.27374
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-14T14:08:37.264291Z'
cvssSource: cna
ingestedAt: '2026-10-14T11:27:22.141Z'
---

## Overview

A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.