PowerDNS DNSdist Vulnerability Let Attackers Cause Denial of Service Condition
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A high-severity vulnerability (CVE-2025-30194) in PowerDNS<\/a> DNSdist, a widely used DNS load balancer and security tool, enables remote attackers to trigger denial-of-service (DoS) conditions by exploiting flaws in its DNS-over-HTTPS (DoH) implementation.\u00a0<\/p>\n The vulnerability, disclosed in PowerDNS Security Advisory, affects DNSdist versions 1.9.0 through 1.9.8 when configured to use the nghttp2 library for DoH processing.<\/p>\n Successful exploitation crashes the DNSdist service via a double-free memory corruption event, disrupting DNS resolution for dependent systems.<\/p>\n The vulnerability stems from improper memory management when handling maliciously crafted DoH exchanges.\u00a0<\/p>\n Attackers exploiting this flaw send specially structured HTTP\/2 requests that cause DNSdist to attempt freeing the same memory region twice-a critical error classified as CWE-416 (Use After Free).\u00a0<\/p>\n This triggers a segmentation fault, terminating the DNSdist process entirely. The attack requires no authentication<\/a> and can be executed remotely over the network, earning it a CVSS v3.1 score of 7.5.<\/p>\n Notably, the issue only manifests in configurations using the nghttp2 provider for incoming DoH traffic, a default setting since DNSdist 1.9.0.\u00a0<\/p>\n Systems relying on the legacy h2o library or earlier DNSdist versions remain unaffected.\u00a0<\/p>\n PowerDNS engineers traced the root cause to an edge-case interaction between nghttp2\u2019s request handling and DNSdist\u2019s internal resource management logic, exacerbated by certain HTTP\/2 frame sequences.<\/p>\n With DNSdist deployed in critical infrastructure roles-including recursive resolver farms, authoritative DNS clusters<\/a>, and DDoS-protected networks-this vulnerability poses significant operational risks.\u00a0<\/p>\n An unpatched instance could suffer prolonged outages, as restarting the crashed service provides only temporary relief until the next attack<\/p>\n The discovery of this vulnerability is credited to Charles Howes, who brought the issue to the attention of PowerDNS.\u00a0<\/p>\n The swift response from<\/a> PowerDNS in releasing a fixed version demonstrates the importance of community involvement in maintaining the security of critical infrastructure software.<\/p>\nHigh-Severity DoS in DNSdist via nghttp2 DoH<\/strong><\/h2>\n