The CVE number for this vulnerability is CVE-2026-19538

= Summary
Anyone with access to the proxy protocol port over TCP or TLS can bypass
BLOCKED access control items.


== Affected products
NSD from and including version 4.8.0 up to and including version 4.15.0


== Description
The BLOCKED access control list items that are evaluated to deny access on the
the proxy protocol port can be bypassed completely when connecting over TCP or
TLS and sending the query twice on connection that is kept open.

With access to the proxy protocol port, the adversary can then spoof any IP and
potentially bypass all IP based access control (for queries, transfers and
notifies).

== Mitigation

=== Downloading patched version
NSD 4.15.1 is released with the patch
https://nlnetlabs.nl/downloads/nsd/nsd-4.15.1.tar.gz

=== Applying the patch manually
For NSD 4.15.0 the patch is:
https://nlnetlabs.nl/downloads/nsd/patch_CVE-2026-19538.diff

Apply the patch on the nsd source directory with:
    patch -p1 < patch_CVE-2026-19538.diff
then run 'make install' to install nsd.

The patch is tested to work on nsd 4.15.0.


== Acknowledgments
We would like to thank Qifan Zhang from Palo Alto Networks for discovering and
responsibly disclosing the vulnerability.