High severity7.5NVD Advisory· Published Apr 29, 2025· Updated Apr 15, 2026
CVE-2025-30194
CVE-2025-30194
Description
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.
The remedy is: upgrade to the patched 1.9.9 version.
A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.
We would like to thank Charles Howes for bringing this issue to our attention.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versionspkg:rpm/opensuse/dnsdist&distro=openSUSE%20Tumbleweedpkg:rpm/suse/dnsdist&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7
< 1.9.10-2.1+ 1 more
- (no CPE)range: < 1.9.10-2.1
- (no CPE)range: < 1.9.10-150700.3.3.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.