Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID: <ced17fcc-4496-4f30-9783-0d08d80e2346@powerdns.com>
Date: Thu, 18 Sep 2025 11:25:20 +0200
From: Remi Gacogne <remi.gacogne@...erdns.com>
To: oss-security@...ts.openwall.com
Subject: PowerDNS Security Advisory 2025-05 for DNSdist: Denial of service via
 crafted DoH exchange

Hi all,

Today we have released PowerDNS DNSdist 1.9.11 and 2.0.1. These releases 
fix PowerDNS Security Advisory 2025-05 for DNSdist, a denial of service 
via crafted DoH exchange.
While working on adding mitigations against the MadeYouReset 
(CVE-2025-8671) attack, we noticed a potential denial of service in our 
DNS over HTTPS implementation when using the nghttp2 provider: an 
attacker might be able to cause a denial of service by crafting a DoH 
exchange that triggers an unbounded I/O read loop, causing an unexpected 
consumption of CPU resources. We assigned CVE-2025-30187 to this issue. 
The offending code was introduced in DNSdist 1.9.0-alpha1 so previous 
versions are not affected.

The full security advisory is provided below, and can also be
found at
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html

Minimal patches can also be found here:
https://downloads.powerdns.com/patches/2025-05/

Please feel free to contact me directly if you have any question.

PowerDNS Security Advisory 2025-05 for DNSdist: Denial of service via 
crafted DoH exchange

- CVE: CVE-2025-30187
- Date: 2025-09-18T12:00:00+02:00
- Discovery date: 2025-08-26T00:00:00+02:00
- Affects: PowerDNS DNSdist from 1.9.0 to 1.9.10, 2.0.0
- Not affected: PowerDNS DNSdist < 1.9.0, 1.9.11, 2.0.1
- Severity: Low
- Impact: Denial of service
- Exploit: This problem can be triggered by an attacker crafting a DoH 
exchange
- Risk of system compromise: None
- Solution: Upgrade to patched version or use the h2o provider
- CWE: CWE-835
- CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Last affected: 1.9.10,2.0.0
- First fixed: 1.9.11,2.0.1
- Internal ID: 308

In some circumstances, when DNSdist is configured to use the nghttp2 
library to process incoming DNS over HTTPS queries, an attacker might be 
able to cause a denial of service by crafting a DoH exchange that 
triggers an unbounded I/O read loop, causing an unexpected consumption 
of CPU resources.
The offending code was introduced in DNSdist 1.9.0-alpha1 so previous 
versions are not affected.

The remedy is: upgrade to a patched version, or switch to the h2o provider.


Best regards,
-- 
Remi Gacogne
PowerDNS.COM BV - https://www.powerdns.com/

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.