CVE-2025-30192 A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts
Attackers can more easily spoof DNS responses for ECS-enabled queries, bypassing security controls unless strict validation settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30192?
CVE-2025-30192 is a high-severity vulnerability in PowerDNS Recursor, published on 21 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.
The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers.
The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.
Weakness: CWE-345
Which versions are affected by CVE-2025-30192?
Linux distribution packages (1)
pdns-recursor openSUSE:Tumbleweed | All versions | 5.2.5-1.1 |
How do I fix CVE-2025-30192?
Change a configuration setting.
Is CVE-2025-30192 being exploited?
There is no known exploitation of CVE-2025-30192 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-30192, GHSA-ph6c-ph44-jm63, UBUNTU-CVE-2025-30192, openSUSE-SU-2025:15478-1.