CVE-2025-30187CWE-835

Denial of service via crafted DoH exchange in PowerDNS DNSdist

Low · published September 18, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-09-18T09:21Z
EPSS history
Timeline
  • 18 SEP 09:21Z
    Denial of service via crafted DoH exchange in PowerDNS DNSdist
    cvelistv5