Medium severity6.5NVD Advisory· Published Mar 31, 2026· Updated Jul 25, 2026
CVE-2026-24029
CVE-2026-24029
Description
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- osv-coords2 versionspkg:rpm/opensuse/dnsdist&distro=openSUSE%20Leap%2016.0pkg:rpm/suse/dnsdist&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7
< 1.9.13-160000.1.1+ 1 more
- (no CPE)range: < 1.9.13-160000.1.1
- (no CPE)range: < 1.9.12-150700.3.9.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.