{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"nsd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQXMNCARQBPCP4SWX4SMRA","modified_at":"2026-10-01T03:02:29.768125319Z","published_at":"2026-08-26T09:16:46.057Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-19538","https://security-tracker.debian.org/tracker/CVE-2026-19538"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-19538#Debian:13/nsd","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-19538"}],"summary":"The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connect"}