CVE-2026-19538 PUBLISHED

Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS

Assigner: NLnet Labs
Reserved: 11.08.2026 Published: 26.08.2026 Updated: 26.08.2026

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Explicitly denied access to the proxy protocol port is bypassed on TCP or TLS

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

Explicitly denied access to the proxy protocol port is bypassed on TCP or TLS

CVSS 4.0

Product Status

Vendor	NLnet Labs
Product	NSD
Versions	Default: unaffected affected from 4.8.0 to 4.15.1 (excl.)

Solutions

This issue is fixed in 4.15.1 and all later versions.

Credits

Qifan Zhang from Palo Alto Networks finder

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt

Problem Types

CWE-290 Authentication Bypass by Spoofing CWE
CWE-672 Operation on a Resource after Expiration or Release CWE