CVE-2025-30187: Denial of service via crafted DoH exchange in PowerDNS DNSdist

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-18 · updated 2026-06-17
Weakness: CWE-835

Description

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Affected products

PowerDNS DNSdist: from 1.9.0 before 1.9.11; from 2.0.0 before 2.0.1 — fixed in 1.9.11, 2.0.1

How to fix

Upgrade to a fixed version: PowerDNS DNSdist 1.9.11, 2.0.1. Check the vendor advisory for mitigations.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html
http://www.openwall.com/lists/oss-security/2025/09/18/1

Get alerted when CVE-2025-30187 or the next vulnerability affects your stack