CVE-2026-19538: high-severity vulnerability in NLnet Labs NSD
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.4%
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
NLnet Labs · NSDRelated CVEs — NLnet Labs NSD
In the same product, most dangerous first.
CVE-2020-28935—Local symlink attack in Unbound and NSDEPSS 0.5%CVE-2026-12244HIGHHeap overflow and crash with crafted SVCB RREPSS 0.5%CVE-2026-19401HIGHRemote UDP DoS by sending multiple DNS Cookie optionsEPSS 0.5%CVE-2026-18916MEDIUMRemote TCP DoS by throttling the TCP receive windowEPSS 0.5%CVE-2026-12245HIGHDenial of DNS over TLS service by any DoT clientEPSS 0.5%CVE-2026-12246HIGHOut of bounds stack write with crafted APL RREPSS 0.4%