Summary
It was discovered that HTTP/2, which is used/vendored by DNSdist, did not
properly account for resources when handling client-triggered stream
resets. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-8671)
It was discovered that DNSdist did not properly manage memory limits when
handling an unlimited number of queries on a single TCP connection. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2025-30193)
It was discovered that DNSdist, when configured with the nghttp2 library,
did not correctly process certain DNS over HTTPS queries. An attacker
could possibly use this cause a denial of service. (CVE-2025-30187)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | dnsdist | 1.9.10-1ubuntu0.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | dnsdist | 1.6.1-1ubuntu0.1~esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | dnsdist | 1.8.3-2ubuntu0.1~esm1 |
Vulnerabilities 3
-
High 7.5
Denial of service via crafted TCP exchange
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a c…
-
High 7.5CVE-2025-8671 Public exploit
CVE-2025-8671
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening stre…
-
Low 3.7
Denial of service via crafted DoH exchange in PowerDNS DNSdist
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an une…