Low severity · published Sep 18, 2025
CVE-2025-30187
Denial of service via crafted DoH exchange in PowerDNS DNSdist
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DN
DNSdist · PowerDNS
1.9.0 before 1.9.11; 2.0.0 before 2.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30187
www.dnsdist.org
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/09/18/1
More from DNSdist
9.1
CVE-2026-33598
Out-of-bounds read in cache inspection via Lua
8.8
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack
8.2
CVE-2026-33602
Off-by-one access when processing crafted UDP responses
8.2
CVE-2026-24028
Out-of-bounds read when parsing DNS packets via Lua
8.1
CVE-2026-33599
Out-of-bounds read in service discovery