PT-2026-29244 · Nghttp2 · Nghttp2

Cavid + 1 · Publicado 2026-01-01 · Atualizado 2026-04-24 · CVE-2026-24029

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions versions prior to the fix for CVE-2026-24029

Description When the early acl drop (or earlyACLDrop in Lua) option is disabled, and a DNS over HTTPs frontend is utilizing the nghttp2 provider, the Access Control List (ACL) check is bypassed. This allows all clients to submit DNS over HTTPS (DoH) queries, irrespective of the configured ACL rules. The default setting for early acl drop is enabled.

Recommendations Ensure the early acl drop option is enabled.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-24029

SUSE-SU-2026:1618-1

Produtos afetados

Nghttp2

Referências · 25

• https://suse.com/security/cve/CVE-2026-27853 · Nota
• https://suse.com/security/cve/CVE-2026-24028 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-24029 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261618-1 · Nota
• https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html · Aviso do Fabricante
• https://bugzilla.suse.com/1261240 · Nota
• https://bugzilla.suse.com/1261237 · Nota
• https://bugzilla.suse.com/1261239 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24029 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-24030 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1618-1 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004466653913425 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-24029 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-24029 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-0397 · Nota