The vulnerability permits a DNS over HTTPS (DoH) client to bypass the configured ACL restrictions when the early_acl_drop option is disabled. This condition causes the ACL check to be skipped, allowing any IP address to send DoH queries to the DNSdist server. As a result, unauthorized clients can consume DNS services, potentially leading to service overutilization, traffic snooping, or covert DNS tunneling. The weakness corresponds to CWE-863, reflecting an improper restriction on the use of a resource.

The flaw affects PowerDNS DNSdist deployments that expose a DoH frontend via the nghttp2 provider. Any configuration that turns off the early_acl_drop flag—whether through the default setting change or intentional modification—makes the server vulnerable. No particular software versions are listed, so any release that allows toggling this flag is susceptible.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS value of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, further indicating low known exploitation. Exploitation requires remote access to the DNSdist configuration or the presence of an enabled DoH interface that utilizes the nghttp2 provider while the early_acl_drop option is turned off. An attacker can then send DNS queries over HTTPS from any origin, bypassing ACL controls.