Should You Worry About CVE-2026-101339? A Decision Guide for NSD Operators

NLnet Labs released NSD 4.15.3 on 14 October 2026 to fix four stack overwrite flaws in the zone file parser affecting versions 4.10.0 through 4.15.2. CVE-2026-101339, rated CVSS v4.0 8.7, allows arbitrary command execution via an out-of-bounds stack write of 191 bytes. This vulnerability requires a zone file fed directly to the server, as files NSD generates itself are not formatted to trigger the flaw. Operators must evaluate their zone file sources.