This security release has fixes for vulnerabilities which were all for cases with specially crafted and formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which NSD is secondary, would not be formatted like this. The zone file had to be fed to NSD directly, but could in multi-tenant configurations, come from an operator controlled provisioning system accessible to third parties. Zone files that are regularly formatted (generated from DNS software) or come from trusted sources would not trigger these vulnerabilities.
- CVE-2026-101337: Reserve correct number of bytes for base64 sequence tokens, regardless of stream decoder phase.
- CVE-2026-101338: No SVCB and/or HTTPS parameters are parsed when the RDATA is already filled to the brim.
- CVE-2026-101339: Fix for dname possibility to overwrite the stack when near the RDATA limit.
- CVE-2026-101341: Also check that RDATA stays within bounds while parsing string tokens under 32 bytes.