Resource exhaustion in dnsdist - CVE-2025-30187

Vulnerability identifier: #VU115968

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-30187

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the nghttp2 library when handling incoming DNS over HTTPS queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

dnsdist
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Fedora
Basesystem Module
Ubuntu
dnsdist (Ubuntu package)
dnsdist
dnsdist-debugsource
dnsdist-debuginfo

Install updates from vendor's website.

dnsdist - addressed in versions 1.9.11, 2.0.1
dnsdist (Ubuntu package) - addressed in versions 1.6.1-1ubuntu0.1~esm2, 1.8.3-2ubuntu0.1~esm1, 1.9.10-1ubuntu0.1
dnsdist - addressed in versions 1.9.11-1.el9, 1.9.11-1.fc41, 1.9.11-1.fc42, 1.9.11-2.el8, 2.0.1-1.el10_2, 2.0.1-1.fc43
dnsdist-debugsource - update to 1.9.11-150700.3.6.1
dnsdist-debuginfo - update to 1.9.11-150700.3.6.1
dnsdist - update to 1.9.11-150700.3.6.1

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html

• Denial of service in PowerDNS DNSdist
• Fedora 42 update for dnsdist
• Fedora 41 update for dnsdist
• Fedora 43 update for dnsdist
• Fedora EPEL 10.2 update for dnsdist
• Fedora EPEL 8 update for dnsdist
• Fedora EPEL 9 update for dnsdist
• Ubuntu update for dnsdist
• SUSE update for dnsdist