CVE-2025-30187

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources...

CVE-2025-30187 Denial of service via crafted DoH exchange in PowerDNS DNSdist

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources...

CVE-2025-30187 Denial of service via crafted DoH exchange in PowerDNS DNSdist

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources...

CVE-2025-30187

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources...

CVE-2025-30187

DNSdist is vulnerable when configured to use the nghttp2 library to process DoH queries. The issue is an unbounded I/O read loop in the DoH path that can cause CPU resource exhaustion (DoS). Affected code appears post-1.9.0-alpha1; various advisories recommend upgrading DNSdist to fixed releases....

CVE-2025-30187 Denial of service via crafted DoH exchange in PowerDNS DNSdist

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources...

dnsdist -- Denial of service via crafted DoH exchange

[email protected] reports: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an...

PT-2025-38305

Name of the Vulnerable Software and Affected Versions DNSdist affected versions not specified Description DNSdist, when configured to utilize the nghttp2 library for processing DNS over HTTPS DoH queries, may be susceptible to a denial of service. A crafted DoH exchange can trigger an unbounded I...

DNSdist 安全漏洞

DNSdist is a highly DNS, DoS and abuse aware load balancer from DNSdist open source. A security vulnerability exists in DNSdist that stems from the use of the nghttp2 library to process DNS over HTTPS queries that may trigger an infinite I/O read loop, which may lead to excessive CPU resource...

Linux Distros Unpatched Vulnerability : CVE-2025-30194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illega...

ROOT-OS-ALPINE-319-CVE-2024-28182 CVE-2024-28182 in rootio-nghttp2 - Patched by Root

Root has patched CVE-2024-28182 in the rootio-nghttp2 package for Root:Alpine:3.19. Multiple fixed versions available...

ROOT-OS-ALPINE-318-CVE-2024-28182 CVE-2024-28182 in rootio-nghttp2 - Patched by Root

Root has patched CVE-2024-28182 in the rootio-nghttp2 package for Root:Alpine:3.18. Multiple fixed versions available...

NewStart CGSL MAIN 7.02 : nghttp2 Multiple Vulnerabilities (NS-SA-2025-0134)

The remote NewStart CGSL host, running version MAIN 7.02, has nghttp2 packages installed that are affected by multiple vulnerabilities: - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wil...

TencentOS Server 4: nghttp2 (TSSA-2024:0928)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0928 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 3: nghttp2 (TSSA-2024:0318)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0318 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

NewStart CGSL MAIN 7.02 : nghttp2 Vulnerability (NS-SA-2025-0078)

The remote NewStart CGSL host, running version MAIN 7.02, has nghttp2 packages installed that are affected by a vulnerability: - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2...

The vulnerability of the nghttp2_on_stream_close_callback() function in the nghttp2 library allows a attacker to cause a service failure.

The vulnerability of the nghttp2onstreamclosecallback function in the nghttp2 library is related to uncontrolled use of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Alibaba Cloud Linux 3 : 0101: nghttp2 (ALINUX3-SA-2022:0101)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0101 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2019-9513: Some HTTP/2 implementations...

Alibaba Cloud Linux 3 : 0212: nghttp2 (ALINUX3-SA-2024:0212)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0212 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-28182: nghttp2 is an implementation of the...

nghttp2 security update

An update is available for nghttp2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libnghttp2 is a library implementing the Hypertext Transfer Protocol version ...