NSD interim mitigations for four stack overwrite CVEs before upgrading to 4.15.3

Operators who cannot upgrade NSD to version 4.15.3 immediately are advised to take interim steps against four stack overwrite CVEs affecting versions 4.10.0 through 4.15.2. The vulnerabilities are triggered only when a crafted zone file is fed directly to NSD, so the guidance focuses on restricting which accounts and pipelines can write zone files. Recommended measures include validating incoming zones with the fixed 4.15.3 checker in an isolated container, rejecting suspicious record shapes before parsing, and running NSD as an unprivileged user with limited write access. Administrators are also urged to monitor for crashes that correlate with reload events. The vendor provides per-CVE patches against 4.15.2 for cases where a full upgrade must wait, and the patched build should be verified after restart.