Every CVE Search/ Get API key

CVE-2025-30194

Denial of service via crafted DoH exchange

7.5 HighFix available

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.29%Up 2.3 points since Apr 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Denial of service via crafted DoH exchange

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2025-14811 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
EUVD-2025-14811
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-487w-xx5j-gqwc 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a...

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
GHSA-487w-xx5j-gqwc
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2025-30194 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
ALPINE-CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 7.5

Denial of service via crafted DoH exchange

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

Record
CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2025-30194 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version. We would like to thank Charles Howes for bringing this issue to our attention.

Record
DEBIAN-CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-30194 7.5

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version. We would like to thank Charles Howes for bringing this issue to our attention.

Record
UBUNTU-CVE-2025-30194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15157-1 No score

dnsdist-1.9.10-2.1 on GA media

These are all security issues fixed in the dnsdist-1.9.10-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15157-1
Updated
2026-11-02
OSVSUSE-SU-2025:01743-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues:

Update to version 1.9.10.

  • CVE-2025-30194: illegal memory access (double-free) when processing specially crafted DoH exchanges leads to a denial-of-service (bsc#1242028).
  • CVE-2025-30193: stack exhaustion when processing too many queries on incoming TCP connections leads to a denial-of-service (bsc#1243378).
Record
SUSE-SU-2025:01743-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.21
 before 1.9.9-r0
1.9.9-r0
dnsdist
Alpine:v3.22
 before 1.9.9-r0
1.9.9-r0
dnsdist
Alpine:v3.23
 before 1.9.9-r0
1.9.9-r0
dnsdist
Alpine:v3.24
 before 1.9.9-r0
1.9.9-r0
dnsdist
Debian:13
 before 1.9.9-1
1.9.9-1
dnsdist
Debian:14
 before 1.9.9-1
1.9.9-1
dnsdist
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.9.10-150700.3.3.1
1.9.10-150700.3.3.1
dnsdist
openSUSE:Tumbleweed
 before 1.9.10-2.1
1.9.10-2.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30194 is a high vulnerability (CVSS 7.5) in Powerdns Dnsdist, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in dnsdist 1.9.9-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open