CVE-2025-30187
Low
Description
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
SeverityLow
CVSS3.7
Exploit probability—
ProductDNSdist
PublishedSep 18, 2025
First seenSep 18, 2025
Weakness typeCWE-835CWE-835
How to fix
Update
- PowerDNS DNSdist1.9.11, 2.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PowerDNS DNSdist | 1.9.0 ≤ v < 1.9.11, 2.0.0 ≤ v < 2.0.1 | 1.9.11, 2.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.