CVE-2026-19538

Awaiting Analysis Awaiting Analysis - Queue

Proxy Protocol Port Access Bypass in Unbound DNS

Publication date: 2026-08-26

Last updated on: 2026-09-08

Assigner: NLnet Labs

Description

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-08

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-19538

EUVD

EUVD-2026-66376

Affected Vendors & Products

Vendor	Product	Version / Range
nlnetlabs	nsd	From 4.8.0 (inc) to 4.15.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-672	The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability allows attackers to bypass access control restrictions on the proxy protocol port by sending a query twice on a connection that remains open. It affects NSD versions 4.8.0 through 4.15.0 and enables IP spoofing, potentially allowing unauthorized access to queries, transfers, and notifies.

Detection Guidance

Check if your NSD version is between 4.8.0 and 4.15.0. Run 'nsd --version' to verify. Monitor proxy protocol port traffic for repeated queries on the same connection. Inspect logs for unexpected access attempts or IP spoofing attempts.

Impact Analysis

Attackers could exploit this to bypass IP-based access controls, gain unauthorized access to sensitive operations like DNS queries or zone transfers, or spoof legitimate IPs to perform malicious actions on your NSD server.

Compliance Impact

This vulnerability allows attackers to bypass IP-based access controls, potentially enabling unauthorized access to sensitive DNS data. For GDPR, this could lead to unauthorized data access or processing, violating principles of data protection and security. For HIPAA, it may compromise protected health information if DNS queries or transfers are intercepted or manipulated.

Mitigation Strategies

Upgrade NSD to version 4.15.1 or later. If upgrading is not possible, apply the manual patch for version 4.15.0 provided by NSD. Restrict access to the proxy protocol port via firewall rules until patched.

Hi! I’m here to help you understand CVE-2026-19538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70