CVE-2026-19538 is a high severity (CVSS 7.5) access control bypass in NLnet Labs NSD. BLOCKED ACL entries on the proxy protocol port can be skipped on a kept-open TCP or TLS connection. NSD 4.8.0 through 4.15.0 are affected. Upgrade to NSD 4.15.1.
What's affected
NLnet Labs says NSD versions 4.8.0 through 4.15.0 inclusive are affected, and NSD 4.15.1 fixes the issue. The NVD record scores it 7.5 (High). The NLnet Labs advisory does not state its own score or severity, so there is no conflict to flag, only a missing rating on the vendor side.
The flaw only matters when you have configured the proxy protocol port and rely on BLOCKED ACL entries there. The weaknesses listed are CWE-290 (authentication bypass by spoofing) and CWE-672 (operation on a resource after expiration or release). The KEV flag is false.
The advisory describes the effect. An attacker who can reach the proxy protocol port can spoof any IP address and get past IP based controls for queries, zone transfers and notifies. That is a meaningful result for any server that uses source address to decide who may transfer a zone.
How to check if you're exposed
Check your NSD version:
nsd -v
If it falls between 4.8.0 and 4.15.0, look at your configuration for the proxy protocol port setting and any access control list entries marked as blocked on that port. If you do not use the proxy protocol port, this flaw does not apply to your configuration in the way the advisory describes, but upgrading is still the clean answer.
If NSD came from a distribution package, check the package changelog, because distributions sometimes backport fixes without changing the upstream version number. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Run
nsd -von every authoritative server and note versions from 4.8.0 to 4.15.0. - Upgrade to NSD 4.15.1, or install your distribution's fixed package.
- If you must stay on 4.15.0 for now, NLnet Labs provides a patch in the advisory. Apply it with patch -p1 and run make install. The advisory says it was tested only on 4.15.0.
- Until you upgrade, restrict who can reach the proxy protocol port at the network layer, so the ACL is not your only barrier.
- Review zone transfer and notify logs for unexpected source addresses.
- Restart NSD and confirm the new version.
Why it matters
An ACL that can be skipped is no ACL. CWE-290 (authentication bypass by spoofing) describes the pattern: the server trusts a claim about who is connecting, and the claim can be forged. Here the check for blocked entries is passed over when a query arrives a second time on a connection that stays open. Sending the same query twice should not change a security decision, and in this case it does.
The second weakness, CWE-672 (operation on a resource after expiration or release), fits a state handling error of that kind. Authoritative DNS servers often use source address to protect zone transfers, so a bypass can expose zone data you meant to keep inside.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I do not use the proxy protocol port?
The advisory ties the bypass to that port. If it is not enabled, your exposure is much smaller, but upgrading to 4.15.1 removes the question.
Is a patch available for 4.15.0 only?
The advisory provides a patch tested only on 4.15.0. For other versions, upgrade to 4.15.1.
Sources
Last reviewed: 18 October 2026.
