No public exploit has been reported for the four NSD stack overwrite flaws fixed in 4.15.3, and SecurityOnline records no confirmed in-the-wild use. That absence is a reason to build detection before the code appears, not a reason to relax. The flaws sit in the zone-file parser, which means the interesting events happen around zone loading rather than around DNS queries.

What the vulnerabilities require

NLnet Labs lists CVE-2026-101338, CVE-2026-101339, CVE-2026-101341 and CVE-2026-101337 as stack overwrites in NSD 4.10.0 through 4.15.2. Each requires a crafted zone file fed directly to the parser. The vendor states that zone files written by NSD itself, as happens for a secondary receiving transfers, will not be formatted the way the attacks require, though a malicious file written into the zone directory by another means still works.
This shapes the detection question. An attacker does not need to talk to port 53. They need a way to place a file where NSD will parse it, and then a reload.

Event sources worth collecting

Start with what the daemon already tells you.

  • Process lifecycle: unexpected exits, restarts, and crash patterns recorded by systemd, supervisord, or the container runtime.

  • Reload activity: nsd-control reload invocations with the account, source host, and zone names involved.

  • File changes: writes to the zone directory, especially files that appear between two reloads without a matching administrative ticket.

  • Validation output: nsd-checkzone results run against recently changed zones.
    The point of correlating these is straightforward. A parser overflow that fails produces a crash shortly after a reload. A parser overflow that succeeds produces no crash at all, but it still required a file write and a reload, and both of those leave traces.

Detection rules that survive the quiet period

Rule one: alert on any NSD exit that is not preceded by an operator-initiated stop. Correlate with reload timestamps from the previous ten minutes. A daemon that dies during zone loading deserves a ticket even if the file turns out to be malformed for a dull reason.
Rule two: alert when a zone file changes outside a known deployment window. This catches a compromised provisioning account before it catches you unprepared.
Rule three: alert when the reload caller is not in the small set of accounts that normally perform DNS changes. In a hosting platform, that set should be managed by the platform, not by individual customers.
Rule four: for platforms that accept customer zone input, run the fixed nsd-checkzone on every incoming zone and alert on validation failures. The 4.15.3 parser includes the corrected boundary checks, so files that look like the CVE shapes are more likely to be rejected there than by older code.

Where internet measurement fits

ZoomEye data supports the prioritization half of hunting rather than the attribution half. A query for app="NSD" returned 116,266 assets at the time of writing, and banner="NSD" returned 628,831. A CVE-scoped query for vul.cve="CVE-2026-101338" returned zero, which is expected so soon after disclosure. Those figures describe how much NSD-like service is visible on the internet; they do not identify versions or vulnerable instances.
If your own organisation appears in that population, the measurement is a reminder that the server is reachable. It is not evidence of compromise in either direction.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOU0Qi

The order of work

Patch first, because the upgrade to 4.15.3 removes the parser bug and makes the hunting questions less urgent. Then instrument, because detection of file writes and reloads is valuable beyond this CVE batch. Then validate, by running the fixed parser against real zones and reviewing what it rejects.

Remediation reference

NSD 4.15.3 is available at https://nlnetlabs.nl/downloads/nsd/nsd-4.15.3.tar.gz. Per-CVE diffs against 4.15.2 exist for controlled backports, for example https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-101339.diff, applied with patch -p1 in the source tree and installed with make install.

References

  • NLnet Labs advisory for CVE-2026-101338: https://nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt

  • NLnet Labs advisory for CVE-2026-101341: https://nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt

  • NLnet Labs advisory for CVE-2026-101339: https://nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt

  • NLnet Labs advisory for CVE-2026-101337: https://nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt

  • SecurityOnline report: https://securityonline.info/nsd-stack-overwrite-vulnerability-patched/