PT-2026-29244 · Nghttp2 · Nghttp2

Cavid + 1 · Published 2026-01-01 · Updated 2026-04-24 · CVE-2026-24029

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions versions prior to the fix for CVE-2026-24029

Description When the early acl drop (or earlyACLDrop in Lua) option is disabled, and a DNS over HTTPs frontend is utilizing the nghttp2 provider, the Access Control List (ACL) check is bypassed. This allows all clients to submit DNS over HTTPS (DoH) queries, irrespective of the configured ACL rules. The default setting for early acl drop is enabled.

Recommendations Ensure the early acl drop option is enabled.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-24029

SUSE-SU-2026:1618-1

Affected Products

Nghttp2

References · 25

• https://security-tracker.debian.org/tracker/CVE-2026-24029 · Vendor Advisory
• https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24029 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1618-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24029 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24029 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24029 · Security Note
• https://suse.com/security/cve/CVE-2026-27853 · Note
• https://suse.com/security/cve/CVE-2026-24028 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261618-1 · Note
• https://bugzilla.suse.com/1261240 · Note
• https://bugzilla.suse.com/1261237 · Note
• https://bugzilla.suse.com/1261239 · Note
• https://suse.com/security/cve/CVE-2026-24030 · Note