EUVD-2026-66376
GHSA-q27j-h4qm-x5f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify NSD instance with proxy protocol port exposed
-
DeliveryEstablish persistent TCP or TLS connection to proxy protocol port
-
ExploitSend DNS query matched by a BLOCKED ACL entry (first query, denied)
-
ExecutionResend identical query on the same open connection
-
PersistACL re-evaluation bypass triggered
-
ImpactReceive otherwise-restricted DNS response data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that NSD be configured with a proxy protocol port (an explicitly configured, non-default feature) and that this port be reachable by the attacker over TCP or TLS. The attacker must maintain a persistent (kept-open) connection rather than a per-query connection, and must issue at least two queries within the same session. The vulnerability specifically targets BLOCKED ACL entries on the proxy protocol port; ACL controls on NSD's standard DNS port are not stated to be affected. Exploitation is impossible against NSD deployments that do not configure a proxy protocol port, which substantially limits the exposed population to DNS operators using upstream load balancers or proxies with PROXY protocol header forwarding. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N scores 8.2, reflecting unauthenticated network-based exploitation with high confidentiality impact. The AT:P (Attack Requirements: Present) qualifier is significant - exploitation is gated on the proxy protocol port being explicitly configured and network-accessible, a non-default deployment condition that substantially reduces the exposed population. No EPSS score was provided in the available intelligence, leaving exploitation probability unquantified by that signal. The CVE is not listed in CISA KEV, and no public proof-of-concept has been identified, consistent with an early-disclosure posture. Despite the non-default configuration requirement, any NSD operator using the proxy protocol feature - from large DNS providers to smaller regional operators - should treat this as an urgent remediation given the bypass is mechanically trivial and yields high-confidentiality-impact DNS data access. The CVSS confidentiality-only impact (VI:N/VA:N) means integrity and availability are not degraded, but unauthorized resolution of restricted DNS data is the direct outcome. |
| Exploit ScenarioDerived | An unauthenticated attacker with TCP or TLS access to NSD's proxy protocol port establishes a persistent connection and issues a DNS query that falls under a BLOCKED ACL entry, receiving a denial. The attacker immediately retransmits the same query on the same open connection; NSD's ACL enforcement logic fails to re-evaluate the BLOCKED rule and responds with the restricted DNS data. No public proof-of-concept code has been identified, but the technique requires only standard TCP and DNS tooling available in any operating system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
RemediationAI
Consult the NLnet Labs vendor advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt for the patched NSD release; a specific fixed version number is not independently confirmed from the data available at time of analysis, so the advisory is the authoritative source for upgrade targeting. As an immediate compensating control where patching cannot be applied, restrict access to the NSD proxy protocol port to only trusted upstream proxy IP addresses via host-level firewall rules or NSD's own ACL configuration, accepting the trade-off that any misconfigured trusted proxy could still trigger the bypass. If the proxy protocol feature is not operationally required, disabling the proxy protocol port entirely eliminates the attack surface with no DNS resolution side effects on the standard query port.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NSD (Name Server Daemon) is an authoritative-only DNS server developed by NLnet Labs, widely used by ISPs, DNS operators, and enterprises as a high-performance alternative to BIND. The proxy protocol port feature allows NSD to accept PROXY protocol headers from upstream load balancers, enabling real client IP transparency behind reverse proxies. CWE-290 (Authentication Bypass by Spoofing) identifies the root cause class: the per-connection access control state machine does not correctly re-apply BLOCKED ACL decisions to subsequent requests on a persistent TCP or TLS session. The affected CPE cpe:2.3:a:nlnet_labs:nsd:*:*:*:*:*:*:*:* covers all NSD releases with no version lower bound, suggesting the flaw is not version-specific but configuration-dependent.
Know when Nsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
AC:H because exploitation requires proxy protocol port to be explicitly configured and reachable - a non-default deployment condition; no privileges or user interaction required; confidentiality-only impact with no integrity or availability degradation.
Primary rating from Vendor (NLnet Labs).
CVSS VectorVendor: NLnet Labs
Lifecycle Timeline
2DescriptionCVE.org
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
Executive ViewAI
NSD DNS servers contain an ACL bypass vulnerability (CVE-2026-19538, CVSS 8.2) affecting all versions, allowing remote unauthenticated attackers to bypass access control policies on DNS queries sent over persistent TCP/TLS connections. No public exploit identified at time of analysis, but the attack mechanic is trivial once the proxy protocol port is reachable. This creates significant organizational risk by allowing attackers to circumvent DNS security controls, enabling potential reconnaissance or unauthorized traffic.
Network segmentation restricting proxy protocol port access to trusted internal subnets only; connection-level rate limiting and connection timeout enforcement on TCP/TLS proxy connections; detailed logging of persistent-connection query patterns to detect exploitation; evaluation and disabling of proxy protocol if not operationally required; DNS firewall rules at network perimeter to enforce ACL policy independently of NSD configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a c
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supp
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data spl
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenti
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave)
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DN
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatc
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents witho
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child proce
Exploit-DB