Security1 hOctober 20, 2026, 13:42

NSD parser flaws reachable via customer TXT records get patched

NLnet Labs disclosed four CVEs in the NSD DNS server on 14 October 2026. Two of them (CVE-2026-101341 and CVE-2026-101337) affect TXT, SPF, DKIM and similar records that hosting customers supply through control panels; the fix ships in NSD 4.15.3 with the simdzone 0.2.7 parser.

DEV Community

Open source

NSD parser flaws reachable via customer TXT records get patched

CVE-2026-101341: TXT tokens under 32 bytes skip RDATA space checks
CVE-2026-101337: base64 RDATA in 3-char chunks allows up to 64 KB writes
Fix is NSD 4.15.3 with the simdzone 0.2.7 parser
ZoomEye counts 116,272 assets matching the NSD banner

#NSD#NLnetLabs

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Security

Revolut customers hit by fresh hack via US stock broker

Security

Citrix patches NetScaler CVE-2026-88771: root RCE via log data

Security

NSD parser flaws reachable via customer TXT records get patched

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Revolut customers hit by fresh hack via US stock broker

Citrix patches NetScaler CVE-2026-88771: root RCE via log data

Traefik ForwardAuth identity spoofing via dot-form header aliases patched