The vulnerability allows a client to bypass all BLOCKED access control list items that would normally deny access when using the proxy protocol port over TCP or TLS. By keeping the connection open and sending the same query twice, an attacker can cause the evaluation to skip the blocking rules, effectively gaining access that should have been denied. This flaw is a direct control-bypass weakness and can lead to unauthorized data exposure or functionality access.

The issue affects NLnet Labs NSD before version 4.15.1. All releases newer than 4.15.1 contain the fix. Users running older versions should update to the patched release to remove the vulnerability.

The CVSS score of 8.2 indicates a high severity impact. The EPSS score is not available, but the lack of a KEV listing suggests that there are no widely known exploits yet. The attack can be performed remotely over an open TCP or TLS connection to the proxy protocol port, especially when the connection is reused for multiple queries. Operators should assume the flaw could be exploited in the wild until the software is patched.