Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-24029

DNS over HTTPS ACL bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PowerDNS DNSdist

Default version status: unaffected

  • 1.9.0 to < 1.9.12affected
  • 2.0.0 to < 2.0.3affected

References