Riskcovery

CVE-2025-30187

Denial of service via crafted DoH exchange in PowerDNS DNSdist

State
Published
Severity
3.7 Low
Published
Sep 18, 2025
Updated
Nov 4, 2025
Reserved
Mar 18, 2025

Read the record on cve.org

Description

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LOX

Weaknesses

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

ProductVersions
DNSdistPowerDNS
  • 1.9.0 to before 1.9.11Affected
  • 2.0.0 to before 2.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.