High severity7.5NVD Advisory· Published May 14, 2024· Updated Jun 17, 2026

CVE-2024-25581

Description

When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nghttp2/Nghttp2inferred
Dnsdist/dnsdistllm-fuzzy
PowerDNS/Dnsdistllm-fuzzy
osv-coords
pkg:rpm/opensuse/dnsdist&distro=openSUSE%20Tumbleweed
Range: < 1.9.4-1.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2024/05/13/1nvd
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2024-03.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000