CVE-2025-30194 Denial of service via crafted DoH exchange
An attacker can cause a denial of service in DNSdist by triggering a double-free crash via a crafted DoH exchange when using the nghttp2 provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30194?
CVE-2025-30194 is a high-severity use after free vulnerability in PowerDNS DNSdist, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.
The remedy is: upgrade to the patched 1.9.9 version.
A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.
We would like to thank Charles Howes for bringing this issue to our attention.
Weakness: CWE-416
Which versions are affected by CVE-2025-30194?
Linux distribution packages (1)
dnsdist openSUSE:Tumbleweed | All versions | 1.9.10-2.1 |
How do I fix CVE-2025-30194?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-30194 being exploited?
There is no known exploitation of CVE-2025-30194 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-30194, GHSA-487w-xx5j-gqwc, openSUSE-SU-2025:15157-1.