Dear all.
NSD 4.15.3 is available:
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz
sha256 6cd323354ebdf8c6a1eb5a14ecce25c69534013b70e7b0197d915cd581ab530c
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz.asc
This security release has fixes for vulnerabilities which were all for cases with specially crafted and formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which NSD is secondary, would not be formatted like this. The zone file had to be fed to NSD directly, but could in multi-tenant configurations, come from an operator controlled provisioning system accessible to third parties. Zone files that are regularly formatted (generated from DNS software) or come from trusted sources would not trigger these vulnerabilities.
The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026:
User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45
The key is available from https://nlnetlabs.nl/signing-keys
BUG FIXES:
- Update to simdzone-0.2.7 with fixes for CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341
simdzone-0.2.7
BUG FIXES:
- Fix for CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase.
Thanks to Qifan Zhang, Palo Alto Networks, and Gaurang Maheta for the report. - Fix for CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim.
Thanks to Qifan Zhang, Palo Alto Networks, for the report. - Fix CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
Thanks to Qifan Zhang, Palo Alto Networks, and Alwaleed Ashi (LXR)
waleed.9998@hotmail.com for the report. - Fix for CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes.
Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report