Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-w2rq-89vw-p64m

Опубликовано: 14 окт. 2026
Источник: github
Github: Не прошло ревью
CVSS4: 8.7

Описание

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

EPSS

Процентиль: 28%
0.0034
Низкий

8.7 High

CVSS4

Дефекты

CWE-121

Связанные уязвимости

ubuntu
26 дней назад

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS3: 8.8
redhat
26 дней назад

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

nvd
26 дней назад

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

debian
26 дней назад

When base64 data is split up in pieces, of 3 character or less, tokens ...

altlinux
7 дней назад

ALT-PU-2026-20084: package `nsd` update to version 4.15.4-alt1

EPSS

Процентиль: 28%
0.0034
Низкий

8.7 High

CVSS4

Дефекты

CWE-121