CVE-2026-19538 Overview
CVE-2026-19538 is an authentication bypass vulnerability [CWE-290] affecting NLnet Labs NSD (Name Server Daemon) on the proxy protocol port. The BLOCKED access control list (ACL) entries that should deny access on the proxy protocol port can be bypassed. An attacker connecting over TCP or TLS can defeat the ACL by sending the same query twice on a persistent connection. The flaw allows network-adjacent adversaries to reach DNS resources that operators explicitly configured to block.
Critical Impact
Remote unauthenticated attackers can bypass NSD BLOCKED ACL rules on the proxy protocol port, defeating an intended security boundary and enabling access to denied DNS resources.
Affected Products
- NLnet Labs NSD authoritative DNS server
- Deployments exposing the proxy protocol port over TCP
- Deployments exposing the proxy protocol port over TLS
Discovery Timeline
- 2026-08-26 - CVE-2026-19538 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-19538
Vulnerability Analysis
The vulnerability resides in how NSD evaluates BLOCKED ACL entries for queries received on the proxy protocol port. The proxy protocol prepends client connection metadata to incoming TCP or TLS sessions so backend servers can attribute traffic to the original source. NSD uses that metadata to match ACL rules, including BLOCKED entries meant to deny queries from specific sources.
When a client keeps the TCP or TLS connection open and issues the same DNS query a second time, NSD fails to re-apply the BLOCKED decision to the follow-up query. The second query is processed as if the ACL check succeeded. The result is a full bypass of the deny rule for any client that can complete a proxy protocol handshake and reuse the connection.
Root Cause
The defect is an authentication and access control state error [CWE-290]. NSD applies the BLOCKED evaluation to the first message on a persistent connection but does not consistently enforce that decision across subsequent queries on the same connection. The server treats the repeated query as trusted, so a denied source can retrieve responses that policy forbids.
Attack Vector
Exploitation requires network reach to the NSD proxy protocol listener and the ability to speak the proxy protocol. The attacker opens a TCP or TLS session, sends a DNS query the ACL should block, keeps the connection open, and sends the identical query a second time. The second query is answered despite the BLOCKED rule. No authentication or user interaction is required.
No verified proof-of-concept code has been published. See the NLnet Labs CVE-2026-19538 advisory for authoritative technical details.
Detection Methods for CVE-2026-19538
Indicators of Compromise
- Repeated identical DNS queries within a single long-lived TCP or TLS session to the NSD proxy protocol port.
- Successful DNS responses to source addresses that appear in NSD BLOCKED ACL configuration.
- Unexpected persistent connections to the proxy protocol port from untrusted networks.
Detection Strategies
- Correlate NSD query logs against configured BLOCKED ACL entries and alert on any successful answer to a denied source.
- Inspect network flow data for TCP or TLS sessions to the proxy protocol port that carry more than one DNS query per connection.
- Baseline expected proxy protocol clients and flag sessions from sources outside that inventory.
Monitoring Recommendations
- Enable verbose query logging on NSD and forward logs to a central platform for retention and correlation.
- Monitor connection duration and query counts per session on the proxy protocol port.
- Track configuration drift on nsd.conf ACL blocks to ensure BLOCKED entries remain in place after upgrades.
How to Mitigate CVE-2026-19538
Immediate Actions Required
- Restrict network reachability of the NSD proxy protocol port to trusted proxy hosts using firewall rules or host-based ACLs.
- Audit nsd.conf for BLOCKED ACL entries and validate whether any denied source can currently reach the proxy protocol listener.
- Apply the fixed NSD release from NLnet Labs as soon as it is available for your platform.
Patch Information
Refer to the NLnet Labs CVE-2026-19538 advisory for the fixed version and upgrade instructions. Operators running NSD from a distribution package should track vendor backports and apply the update once published.
Workarounds
- Disable the proxy protocol port on NSD if it is not required in the deployment.
- Terminate proxy protocol connections at an upstream load balancer that enforces the same BLOCKED policy before traffic reaches NSD.
- Enforce per-connection query limits or short idle timeouts on the proxy protocol listener to reduce the window for the repeat-query bypass.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
