Executive brief
NSD is a widely deployed DNS authoritative nameserver. An attacker with network access to the proxy protocol port can bypass IP-based access controls by sending queries twice over a persistent connection, allowing them to forge the source IP of DNS queries and potentially circumvent all IP-based security restrictions on queries, zone transfers, and notifications.
Technical details
The vulnerability exists in NSD's handling of access control lists (ACLs) on the proxy protocol port. BLOCKED ACL items that should deny access over TCP or TLS connections can be completely bypassed by sending a DNS query twice on a persistent (keep-alive) connection. The root cause stems from improper validation of the proxy protocol headers or query processing logic. An unauthenticated network attacker with access to the proxy protocol port can exploit this flaw to spoof arbitrary source IP addresses, effectively bypassing all IP-based access controls applied to queries, zone transfers, and notifications. Patched versions 4.15.1 and later address this issue; a patch is also available for manual application to NSD 4.15.0.
Affected products
- NLnet Labs NSD 4.8.0 to 4.15.0
Timeline
- 2026-08-26: disclosed
- 2026: patched: NSD 4.15.1 released with patch; patch available for 4.15.0