CVE-2026-19538

HighCVSS 7.5/10Last modified Sep 8, 2026

Description

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290CWE-672

Affected software

VendorProductVersions
NLnet LabsNSD>= 4.8.0, < 4.15.1

References

Timeline

Published
Aug 26, 2026
Last modified
Sep 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-195398.6Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authentiCVE-2026-195416.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client CVE-2026-195425.6Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocatCVE-2026-195436.2IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively onCVE-2026-195468.8A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, DescriptioCVE-2026-195477.0Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searcCVE-2026-195485.5Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component ofCVE-2026-195508.2A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-admiCVE-2026-195520.0When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.CVE-2026-195537.6ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missCVE-2026-195568.8Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a craCVE-2026-195578.3Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer proces
CVE-2026-19538: High severity, CVSS 7.5 | Vulnix