TI-2026-19358 Aliases CVE-2026-24029 GHSA-hh36-f69g-hq4h

DNS over HTTPS ACL bypass

LOW 34CWE-863Published 2026-03-31 · Updated 2026-03-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00154 4th percentileScored 2026-11-07

Fix Fixed DNSdist (PowerDNS): 1.9.12, 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PowerDNS	DNSdist	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	1.9.12, 2.0.3	Patch available	CNA

DNSdist VendorPowerDNS Affected 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Fixed in 1.9.12, 2.0.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:powerdns:dnsdist::::::::	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	Vulnerable	PowerDNS

cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Vulnerable ·PowerDNS

Remediation

Fix · CNA DNSdist (PowerDNS) Fixed in 1.9.12, 2.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-31
PowerDNS DNSdist 1.9.12, 2.0.3
7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-19357 Out-of-bounds read when parsing DNS packets via LuaPriority MEDIUM 44
- TI-2026-19359 Unbounded memory allocation for DoQ and DoH3Priority MEDIUM 40
- TI-2026-22204 Use after free when parsing EDNS options in LuaPriority LOW 33
Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-24029
2026-10-03 Alias added: GHSA-hh36-f69g-hq4h

References

Advisory 1

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html

TI-2026-19357 Out-of-bounds read when parsing DNS packets via Lua CVSS 3.1HIGH 8.2
TI-2026-25980 Out-of-bounds read in cache inspection via Lua CVSS 3.1CRITICAL 9.1
TI-2026-19359 Unbounded memory allocation for DoQ and DoH3 CVSS 3.1HIGH 7.5
TI-2017-05198 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. CVSS 3.0HIGH 8.8
TI-2016-06076 Improper input validation in Open-Xchange GmbH dnsdist CVSS 3.0HIGH 7.5
TI-2026-25977 DoQ/DoH3 excessive memory allocation CVSS 3.1HIGH 7.5

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences