Home

Description

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

PUBLISHED Reserved 2026-01-20 | Published 2026-03-31 | Updated 2026-03-31 | Assigner OX




MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Problem types

Incorrect Authorization

Product status

Default status
unaffected

1.9.0 (semver) before 1.9.12
affected

2.0.0 (semver) before 2.0.3
affected

Credits

Surya Narayan Kushwaha (aka Cavid) finder

References

www.dnsdist.org/...owerdns-advisory-for-dnsdist-2026-02.html

cve.org (CVE-2026-24029)

nvd.nist.gov (CVE-2026-24029)

Download JSON