CVE-2025-30187
Fixed in a distro release EPSS <1%CVSS 3.7
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
Products: powerdns dnsdist
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | dnsdist | 1.9.10-1+deb13u1 |
| Debian 14 | dnsdist | 2.0.1-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | dnsdist | 1.9.11-150700.3.6.1 |
| SUSE Linux Enterprise Server 16.0 | dnsdist | 1.9.11-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | dnsdist | 1.9.11-160000.1.1 |
| Ubuntu 25.10 | dnsdist | 1.9.10-1ubuntu0.1 |
| Ubuntu Pro 22.04 LTS | dnsdist | 1.6.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | dnsdist | 1.8.3-2ubuntu0.1~esm1 |
| openSUSE Leap 16.0 | dnsdist | 1.9.11-160000.1.1 |