High severity · published Aug 26, 2026
CVE-2026-19538
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
NSD · NLnet Labs
4.8.0 before 4.15.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19538
Vendor Advisory
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt
More from NSD
9.1
CVE-2026-18664
Wrong interpretation of ACL ranges
8.8
CVE-2026-12244
Heap overflow and crash with crafted SVCB RR
8.7
CVE-2026-101341
Stack overwrite from specially formatted TXT-DATA RDATA field
8.7
CVE-2026-101339
Stack overwrite from a specially crafted and formatted HIP RR
8.7
CVE-2026-101338
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR