CVE-2026-24029

6.5 mediumEPSS 0.2%

Medium (6.5) in powerdns dnsdist. EPSS 0.2% chance of exploitation in the next 30 days.

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-03-31
Modified: 2026-07-25
Record from: the NVD, synced 2026-10-19

Affected

powerdns:dnsdist

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html

Check your stack JSON