CVE-2025-30194
HIGHEPSS 78th pctlDescription
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version. We would like to thank Charles Howes for bringing this issue to our attention.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploit Intelligence
Elevated risk: more likely to be exploited than 78% of all known CVEs.
References
- https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-02.html
- http://www.openwall.com/lists/oss-security/2025/04/29/1
- https://www.vicarius.io/vsociety/posts/cve-2025-30194-detection-dnsdist-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-30194-mitigate-dnsdist-vulnerability
Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-06-20.