Critical DoS Threat Discovered in PowerDNS DNSdist Due to DoH Vulnerability (CVE-2025-30194)
A newly uncovered high-impact vulnerability—CVE-2025-30194—has been identified in PowerDNS DNSdist, a key component in modern DNS traffic management. This flaw enables unauthenticated, remote attackers to crash services by targeting DNS-over-HTTPS (DoH) capabilities, potentially crippling DNS infrastructure in affected networks.
According to an official advisory from PowerDNS, the bug impacts DNSdist versions 1.9.0 through 1.9.8, but only when configured with the nghttp2 library—used for handling DoH requests. Environments running older versions or alternative libraries such as h2o remain secure.
At the heart of the issue lies a double-free memory error, where DNSdist mistakenly attempts to deallocate the same memory space twice. This results in a segmentation fault, causing the entire DNSdist process to crash—a textbook case of a CWE-416: Use After Free vulnerability. With a CVSS v3.1 score of 7.5, the risk level is officially classified as High.
What makes this vulnerability especially dangerous is its zero-authentication requirement: an attacker needs only remote access to exploit the flaw using specially crafted HTTP/2 messages, requiring no prior credentials or privileged access. The problem arises from a subtle flaw in how DNSdist and nghttp2 manage resource lifecycles when parsing specific HTTP/2 frame sequences.
Given that DNSdist serves as a front-line component in recursive resolvers, authoritative servers, and DDoS-mitigated environments, unaddressed systems could face repeated crashes and significant service disruptions. Even manual restarts offer only temporary relief—each subsequent attack can trigger another failure until the flaw is patched.
The vulnerability was responsibly reported by Charles Howes, whose diligence led to the swift release of a fix by PowerDNS. The company’s rapid response highlights the essential role of collaborative research and community vigilance in securing foundational internet infrastructure.
Organizations running DNSdist in production are strongly urged to upgrade immediately to a patched release to eliminate this threat and maintain service resilience.
Risk Overview
| Factor | Description |
|---|---|
| Impacted Versions | PowerDNS DNSdist 1.9.0 through 1.9.8 (resolved in version 1.9.9) |
| Security Impact | Remote denial-of-service (DoS) vulnerability |
| Conditions for Exploit | DNSdist must be set up to handle DNS-over-HTTPS (DoH) via the nghttp2 library |
| CVSS v3.1 Rating | 7.5 – High severity |
Mitigation Guidance
To address this vulnerability, it is strongly recommended that users upgrade to DNSdist version 1.9.9, which contains the official fix.
If an immediate upgrade is not feasible, a temporary mitigation involves switching the DoH backend from nghttp2 to the alternative h2o provider. This change disables the vulnerable code path while keeping DNS-over-HTTPS functionality intact.
Taking prompt action is critical. This flaw underscores the broader necessity of maintaining up-to-date software—especially in essential infrastructure like DNS resolvers. As adoption of DoH accelerates, safeguarding its implementation is vital to preventing service outages and preserving network reliability.
All users are urged to either apply the update or implement the workaround to mitigate the risk of exploitation.
