CVE-2026-24029
Medium · 6.5CVSS
6.5
EPSS
0.1%
Published
Mar 31, 2026
CISA due date
—
The record
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dnsdist | 0 | 1.9.13-160000.1.1 |
Related vulnerabilities
- CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code calls… Also affects dnsdist
- CVE-2026-33596 A client might theoretically be able to cause a mismatch between queries sent to a… Also affects dnsdist
- CVE-2026-33602 A rogue backend can send a crafted UDP response with a query ID off by one related to the… Also affects dnsdist
- CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers… Also affects dnsdist
- CVE-2026-33597 PRSD detection denial of service Also affects dnsdist
- CVE-2026-33254 An attacker can create a large number of concurrent DoQ or DoH3 connections, causing… Also affects dnsdist
- CVE-2026-33594 A client can trigger excessive memory allocation by generating a lot of queries that are… Also affects dnsdist
- CVE-2026-33595 A client can trigger excessive memory allocation by generating a lot of errors responses… Also affects dnsdist