Alpine: multiple nsd packages: security update to 4.14.3-r1

high Tenable Self-Hosted Container Security Plugin ID 477155

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to
produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.
Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary,
will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for
example, from an operator controlled provisioning system). (CVE-2026-101337)

- When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may
overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of
unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD
instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it
could come, for example, from an operator controlled provisioning system). (CVE-2026-101338)

- A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP
Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files
which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not
be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from
an operator controlled provisioning system). (CVE-2026-101339)

- Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the
space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an
overwrite of a callback function pointer which is called directly after parse. Zone files which are
written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted
like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator
controlled provisioning system). (CVE-2026-101341)

Solution

Update the nsd library and its related packages to version 4.14.3-r1 or later.

Plugin Details

Severity: High

ID: 477155

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/23/2026

Updated: 10/23/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.2

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-101338

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-101341

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/14/2026

Reference Information

CVE: CVE-2026-101337, CVE-2026-101338, CVE-2026-101339, CVE-2026-101341

Detections

Analytics