CVE-2026-19538: CWE-290 Authentication Bypass by Spoofing in NLnet Labs NSD

This vulnerability in NLnet Labs NSD 4.8.0 involves bypassing access control list restrictions that are designed to deny access on the proxy protocol port. The bypass occurs when an attacker connects over TCP or TLS and sends the query twice on a connection that remains open, effectively circumventing the BLOCKED ACL items. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing). No official patch or remediation level has been published by the vendor as of the provided data.

Successful exploitation allows an attacker to bypass access control restrictions on the proxy protocol port, potentially granting unauthorized access to services or data that should be blocked. The CVSS 4.0 base score of 8.2 indicates a high severity impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability does not affect confidentiality, integrity, or availability directly but compromises authentication controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the proxy protocol port through external means such as firewall rules or network segmentation to limit exposure. Monitor for updates from NLnet Labs regarding patches or official mitigations.