CVE-2026-24029

DNS over HTTPS ACL bypass

Medium · published March 31, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Published
2026-03-31T11:59Z
EPSS history
Timeline
  • 31 MAR 11:59Z
    DNS over HTTPS ACL bypass
    cvelistv5