Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-24029: dnsdist allows any client to use DoH when ACL disabled
CVE-2026-24029 · published 7 months ago
Summary
If the early_acl_drop setting is turned off on dnsdist, the access‑control list is not checked for DNS‑over‑HTTPS requests. This lets anyone on the network send DoH queries, bypassing your intended restrictions. Keep the early_acl_drop option enabled or review your configuration to ensure only authorized clients can use DoH.
What to do
- Update debian dnsdist to version 1.9.14-0+deb13u1.
- Update debian dnsdist to version 2.0.3-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | dnsdist | All versions |
| Debian:12 | debian | dnsdist | All versions |
| Debian:13 | debian | dnsdist |
< 1.9.14-0+deb13u1 Fix: upgrade to 1.9.14-0+deb13u1
|
| Debian:14 | debian | dnsdist |
< 2.0.3-1 Fix: upgrade to 2.0.3-1
|
| Ubuntu:16.04:LTS | canonical | dnsdist | All versions |
Original advisory text
DNS over HTTPS ACL bypass
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
References
- https://security-tracker.debian.org/tracker/CVE-2026-24029 Vendor Advisory
- https://repo.powerdns.com/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24029... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-24029 Vendor Advisory
- https://github.com/PowerDNS/pdns Product
- https://ubuntu.com/security/CVE-2026-24029 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-24029 Third Party Advisory
- https://downloads.powerdns.com/patches/2026-02/ Third Party Advisory
- https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-0... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-863Incorrect Authorization
Timeline
Published31 Mar 2026
Updated28 Oct 2026
First seen31 Mar 2026
Sources
CVE-2026-24029 · NVD
DEBIAN-CVE-2026-24029 · OSV
CVE-2026-24029 · OSV
UBUNTU-CVE-2026-24029 · OSV
Track software like this
Free during beta