CVE-2025-30194CWE-416

Denial of service via crafted DoH exchange

High · published April 29, 2025

CVSS v3.1
7.5
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02250 · 82.8th percentile
Weakness
CWE-416 · Use After Free
Published
2025-04-29T11:25Z
EPSS history
Timeline
  • 29 APR 11:25Z
    Denial of service via crafted DoH exchange
    cvelistv5