TI-2025-21523 Aliases CVE-2025-30187 GHSA-2qmc-ch65-q9cm

Denial of service via crafted DoH exchange in PowerDNS DNSdist

LOW 17CWE-835Published 2025-09-18 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00302 23rd percentileScored 2026-11-07

Fix Fixed DNSdist (PowerDNS): 1.9.11, 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PowerDNS	DNSdist	1.9.0 to before 1.9.11; 2.0.0 to before 2.0.1	1.9.11, 2.0.1	Patch available	CNA

DNSdist VendorPowerDNS Affected 1.9.0 to before 1.9.11; 2.0.0 to before 2.0.1 Fixed in 1.9.11, 2.0.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:powerdns:dnsdist::::::::	—	—	PowerDNS

cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* Versions — — ·PowerDNS

Remediation

Fix · CNA DNSdist (PowerDNS) Fixed in 1.9.11, 2.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-30187
2026-10-03 Alias added: GHSA-2qmc-ch65-q9cm

References

Other 1

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html

TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
TI-2015-01678 The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and… CVSS 2.0HIGH 7.8
TI-2021-14878 PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by… CVSS 3.1HIGH 7.5
TI-2016-04703 PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . CVSS 3.0HIGH 7.5
TI-2018-12065 Out-of-bounds read in [UNKNOWN] pdns-recursor CVSS 3.0HIGH 7.5

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences