When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-24b48c1f89 advisory.


        Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and     CVE-2026-101341         Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of     stream decoder phase.
        Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt         Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled     to the brim.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt         Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
        Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the     report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt         Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under     32 bytes.
        Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report         https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-447c66a9bc advisory.


        Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and     CVE-2026-101341         Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of     stream decoder phase.
        Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt         Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled     to the brim.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt         Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
        Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the     report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt         Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under     32 bytes.
        Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report         https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to
    produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.
    Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary,
    will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for
    example, from an operator controlled provisioning system). (CVE-2026-101337)

  - When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may
    overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of
    unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD
    instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it
    could come, for example, from an operator controlled provisioning system). (CVE-2026-101338)

  - A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP
    Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files
    which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not
    be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from
    an operator controlled provisioning system). (CVE-2026-101339)

  - Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the
    space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an
    overwrite of a callback function pointer which is called directly after parse. Zone files which are
    written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted
    like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator
    controlled provisioning system). (CVE-2026-101341)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3d49d46891 advisory.


        Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and     CVE-2026-101341         Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of     stream decoder phase.
        Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt         Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled     to the brim.
        Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt         Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
        Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the     report.
        https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt         Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under     32 bytes.
        Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report         https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bac88b3f-c8a1-11f1-866a-3c7c3fba4204 advisory.

    NLnet Labs reports:
    This security release has fixes for vulnerabilities which were all for cases with specially crafted and     formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which     NSD is secondary, would not be formatted like this. The zone file had to be fed to NSD directly, but could     in multi-tenant configurations, come from an operator controlled provisioning system accessible to third     parties. Zone files that are regularly formatted (generated from DNS software) or come from trusted     sources would not trigger these vulnerabilities.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may     overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of     unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD     instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it     could come, for example, from an operator controlled provisioning system). (CVE-2026-101338)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376134	Fedora 44 : nsd (2026-24b48c1f89)	Nessus	Fedora Local Security Checks	Local	high
376128	Fedora 43 : nsd (2026-447c66a9bc)	Nessus	Fedora Local Security Checks	Local	high
478248	Alpine: multiple nsd packages: security update to 4.13.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478248	Alpine: multiple nsd packages: security update to 4.13.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478247	Alpine: multiple nsd packages: security update to 4.11.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478247	Alpine: multiple nsd packages: security update to 4.11.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478244	Alpine: multiple nsd packages: security update to 4.12.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478244	Alpine: multiple nsd packages: security update to 4.12.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
374654	Fedora 45 : nsd (2026-3d49d46891)	Nessus	Fedora Local Security Checks	Local	high
477155	Alpine: multiple nsd packages: security update to 4.14.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
477155	Alpine: multiple nsd packages: security update to 4.14.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
366447	FreeBSD : NSD -- multiple vulnerabilities (bac88b3f-c8a1-11f1-866a-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	Local	high
365997	Linux Distros Unpatched Vulnerability : CVE-2026-101338	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-101338

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high