CVE-2025-30187
Denial of service via crafted DoH exchange in PowerDNS DNSdist
Summary
Denial of service via crafted DoH exchange in PowerDNS DNSdist
Original description
The description as published by the source.
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-30187 dnsdist Fixed in: 1.9.10-1+deb13u1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory dnsdist.org
- package github.com
- web openwall.com
- web repo.powerdns.com