CVE-2025-30187 — Infinite Loop in Dnsdist
Severity
3.7LOWNVD
EPSS
0.0%
top 98.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 18
Latest updateFeb 12
Description
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 2.2 | Impact: 1.4
Affected Packages3 packages
🔴Vulnerability Details
4OSV▶
CVE-2025-30187: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to↗2025-09-18
GHSA▶
GHSA-2qmc-ch65-q9cm: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to↗2025-09-18