CVE-2025-30194 Summary
CVE Identifier: CVE-2025-30194
Discovery Date: April 25, 2025
Public Release Date: April 29, 2025
Affected Versions: PowerDNS Dnsdist versions 1.9.0 to 1.9.8
Unaffected Versions: PowerDNS Dnsdist 1.9.9 and earlier than 1.9.0
Severity Level: High
Impact: Denial of Service (DoS)
Exploitation Method: The issue is triggered by an attacker crafting a DoH (DNS over HTTPS) exchange.
System Compromise Risk: None identified
Recommended Actions: Update to the patched version or temporarily switch to H2O provider
CWE Classification: CWE-416 (Use After Free)
CVSS Score: 7.5 (for configurations where incoming DoH is enabled via NGHTTP2)
Last Affected Version: 1.9.8
First Patched Version: 1.9.9
Internal ID: 297
Technical Overview
The bug arises specifically when PowerDNS Dnsdist is configured to deliver DNS over HTTPS (DoH) using the NGHTTP2 provider. An attacking entity can exploit the vulnerability by initiating a crafted DoH exchange, causing an illegal memory access due to a double-free condition. This situation leads to a crash of Dnsdist, effectively producing a denial of service (DoS) scenario.
When the incoming DoH is enabled through the NGHTTP2 provider, the CVSS score of 7.5 indicates that the vulnerability presents a significant risk to setups relying on this configuration. While no system compromise is anticipated, the service disruption can impede DNS resolution processes reliant on Dnsdist, impacting users and services that require continuous DNS availability.
Mitigation Strategies
To address this vulnerability, users are strongly advised to upgrade to the patched version, 1.9.9, which fixes the issue and restores service reliability. Alternatively, organizations may choose to temporarily switch to the H2O provider, which is not affected by this vulnerability, until they can complete the necessary upgrades.
Acknowledgments
Special acknowledgment is due to Charles Howes, whose actions brought attention to this critical issue. The timely discovery and notification facilitated quicker response efforts to mitigate potential disruptions for users relying on PowerDNS Dnsdist functionalities.
In summary, CVE-2025-30194 highlights a significant vulnerability within PowerDNS Dnsdist versions 1.9.0 through 1.9.8 that can be exploited to initiate denial of service via crafted DoH exchanges. Immediate action is required to update to version 1.9.9 or switch providers to maintain service continuity and protect DNS infrastructure from potential disruption.