Lucene search
+L

CVE-2025-30194

🗓️ 29 Apr 2025 11:25:47Reported by OXType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 91 Views

CVE-2025-30194 allows DoH attacks on DNSdist causing crashes. Upgrade to version 1.9.9 for fix.

Related
Affected
Refs
Social
[
  {
    "collectionURL": "https://repo.powerdns.com/",
    "defaultStatus": "unaffected",
    "modules": [
      "DNS over HTTPS"
    ],
    "packageName": "dnsdist",
    "product": "DNSdist",
    "programFiles": [
      "dnsdist-doh-common.hh"
    ],
    "repo": "https://github.com/PowerDNS/pdns",
    "vendor": "PowerDNS",
    "versions": [
      {
        "lessThan": "1.9.9",
        "status": "affected",
        "version": "1.9.0",
        "versionType": "semver"
      }
    ]
  }
]

syedaquib77

Vulnerability Update: High-Severity DoS Vulnerability in PowerDNS DNSdist CVE: CVE-2025-30194 Timeline: No changes detected. Disclosure and Patch dates 2025-04-29 remain. exploitMaturity: No changes detected. Exploit maturity is not specifically updated, still implied as remotely exploitable without privileges or user interaction. affectedVersions: No changes detected. Affected versions remain 1.9.0 through 1.9.8. fixedVersions: No changes detected. Fixed version remains 1.9.9. Summary: The vulnerability CVE-2025-30194 continues to affect PowerDNS DNSdist versions 1.9.0 through 1.9.8 when configured with the nghttp2 DoH provider, causing a high-severity DoS via double-free memory corruption. The existing advisory and patch release timeline remain consistent, with version 1.9.9 fixed. New references to the official PowerDNS blog release announcement and Tenable's CVE page provide additional authoritative sources. No updates to severity or exploit maturity were observed. Description: No significant change. The description continues to emphasize a high-severity denial-of-service (DoS) vulnerability due to a Use After Free (double-free) condition triggered remotely via crafted DNS over HTTPS (DoH) requests, causing DNSdist versions 1.9.0 through 1.9.8 to crash. The recommended fix is to upgrade to version 1.9.9; a temporary workaround is to switch to the h2o provider. This update adds a more detailed explanation of the exploit mechanism—specifically the use of a hardcoded machineKey—highlighting new insights. Impact Scope: Recommended Actions: - Upgrade to version 1.9.9 or later - Temporarily switch to the h2o provider as workaround Related Resources: - https://t.co/bDn96Ncjoi - https://t.co/5COpN5Nh6l Tags: #Cybersecurity

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 09:08Current
7.5High risk
Vulners AI Score7.5
CVSS 3.17.5
EPSS0.02238
SSVC
91