EUVD-2026-66376
GHSA-q27j-h4qm-x5f7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires proxy protocol port to be explicitly configured and reachable - a non-default deployment condition; no privileges or user interaction required; confidentiality-only impact with no integrity or availability degradation.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
3DescriptionCVE.org
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
AnalysisAI
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that NSD be configured with a proxy protocol port (an explicitly configured, non-default feature) and that this port be reachable by the attacker over TCP or TLS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N scores 8.2, reflecting unauthenticated network-based exploitation with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NLnet Labs vendor advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt for the patched NSD release; a specific fixed version number is not independently confirmed from the data available at time of analysis, so the advisory is the authoritative source for upgrade targeting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all NSD deployments with proxy protocol enabled and implement firewall rules restricting proxy protocol port access to authorized internal clients only; note that no vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a deni
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today