LoginSign Up
← Back to all sparks
N

NSD

DEVOPS
Velocity0.0

Authoritative DNS name server from NLnet Labs

nlnetlabs.nl/projects/nsd ↗

Memory work paid off, then a serious SVCB overflow arrived — and Prometheus users get a breaking relabel.

dnsauthoritative-nameservermemory-optimizationprometheuscve-responserelease-candidates
◆Current state
NSD's recent history runs through three arcs. The 4.14.0 release refactored RDATA storage to cut memory footprint, a regression was reported immediately for zones with large RRsets, and 4.14.1 closed that gap so consumption dropped in all cases. In June, 4.14.3 fixed two CVEs, one a heap overflow of up to 65,509 attacker-controlled bytes reachable through a crafted SVCB record. Then 4.15.0 moved zone identity in Prometheus metrics from the metric name into a label, with an explicit warning that current users must adapt. Every release ships as an rc1 with identical notes before the final.
◆Where it's heading
This is a mature authoritative nameserver where the remaining work is footprint, correctness and observability rather than protocol features. The memory refactor and its follow-up show a project willing to ship a structural change and then immediately correct for reported regressions. The SVCB overflow is a reminder that newer record types are where the parsing risk now lives, since the older ones have been fuzzed for two decades. NLnet Labs also rotated its release signing key at the start of 2026 and documents the fingerprint in each announcement.
◆Prediction
Expect the Prometheus relabeling to generate follow-up fixes as operators hit dashboard breakage, and continued attention to newer record type parsing. The rc-then-final rhythm makes the next release predictable in shape if not in content.

◆Recent moves

  1. 1mo ago

    Prometheus metrics move zone from metric name to label

    Many bug fixes plus one feature: Prometheus metrics now carry the zone as a label rather than embedding it in the metric name, which lets Prometheus aggregate and filter across zones properly. The release notes warn explicitly that everyone using the current metrics must adapt, so existing dashboards and alert rules will break on upgrade.

    View source ↗
  2. 1mo ago

    Release candidate for 4.15.0 with identical notes

    The maintainer's pre-release of 4.15.0, carrying identical notes to the final a week later. Part of this project's consistent practice of publishing a release candidate before every release.

    View source ↗
  3. 1mo ago

    Heap overflow via crafted SVCB records patched

    A security release fixing two CVEs, the more serious being a heap overflow of up to 65,509 attacker-controlled bytes triggered by a crafted SVCB record, reported by a researcher at Palo Alto Networks. The second affects deployments configured for DNS over TLS.

    View source ↗
  4. 4mo ago

    IXFR processing fix for collated add and delete records

    A two-item bugfix release correcting IXFR processing so collected records are committed before deletions when additions and deletions are collated in the same packet. Narrow zone transfer correctness with no other change.

    View source ↗
  5. 4mo ago

    Release candidate for the 4.14.2 IXFR fix

    The release candidate for 4.14.2, published a week earlier with the same two fixes. Contains nothing beyond the final release.

    View source ↗
  6. 5mo ago

    Memory regression from the RDATA refactor closed

    Closes the memory regression that 4.14.0's RDATA storage refactor introduced for zones with RRsets containing many records, so footprint now drops in all cases rather than most. Also adds container build files and fixes issues that surfaced from the new storage code.

    View source ↗