---
id: CVE-2026-101339
title: >-
  A HIP resource record that fills the RDATA near or at is limit, and has
  another dname RDATA field (a HIP Rendezvous server) can overwrite the stack
  with up to 191 bytes of attacker controlled data
summary: >-
  A HIP resource record that fills the RDATA near or at is limit, and has
  another dname RDATA field (a HIP Rendezvous server) can overwrite the stack
  with up to 191 bytes of attacker controlled data.  Zone files which are
  written out by NS…
severity: none
cwe:
  - CWE-121
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:57.300'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101339'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt'
    label: sep@nlnetlabs.nl
tags:
  - nvd
ingestedAt: '2026-10-14T11:27:22.141Z'
---

## Overview

A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.