Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2025-30187

Denial of service via crafted DoH exchange in PowerDNS DNSdist

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PowerDNS DNSdist

Default version status: unaffected

  • 1.9.0 to < 1.9.11affected
  • 2.0.0 to < 2.0.1affected

References