Dnsdist CVE-2026-24029

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated attackers can exploit this with minimal complexity, resulting in partial confidentiality and integrity impact (C:L, I:L, A:N). The real-world risk is significant because: (1) dnsdist operators who intentionally disable early_acl_drop for performance reasons (e.g., to allow certain queries first) are directly vulnerable; (2) DoH queries bypass traditional network-layer ACL enforcement, making application-layer checks critical; (3) information disclosure occurs when unauthorized clients obtain DNS query responses, revealing internal network topology and host resolution patterns; (4) integrity impact emerges if attackers can inject malicious DNS responses or perform cache poisoning through unauthorized forwarding. However, this requires explicit misconfiguration (disabling a security feature), which may limit exposure scope compared to default-vulnerable deployments. The lack of availability impact and the configuration-dependent trigger slightly reduce severity from a system-wide perspective, though organizations running DoH with ACL-restricted resolvers face direct exposure.

An attacker on the public internet sends a DNS over HTTPS query to a dnsdist instance with a misconfigured nghttp2 frontend (early_acl_drop disabled). The dnsdist resolver, which should be restricted to internal or authorized clients only via ACL rules, accepts the query without ACL evaluation and forwards it to the backend resolver, returning the DNS response. This allows the attacker to enumerate internal hostnames, discover network topology, or perform reconnaissance of the targeted organization's infrastructure without authentication.