CVE-2025-30187

Published: Sep 18, 2025Modified: Jun 17, 2026Deferred

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.2 / Impact: 1.4

Source: security@open-xchange.com (Secondary)

Description

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (2)

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html

Source: security@open-xchange.com

http://www.openwall.com/lists/oss-security/2025/09/18/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.