Description
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.
The remedy is: upgrade to the patched 1.9.9 version.
A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.
We would like to thank Charles Howes for bringing this issue to our attention.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PowerDNS | DNSdist | 1.9.0 – < 1.9.9 | 1.9.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dnsdist | 1.9.9-1 | — |
| Debian 13 | dnsdist | 1.9.9-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dnsdist | 1.9.10-150700.3.3.1 | SUSE-SU-2025:01743-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dnsdist | 1.9.10-2.1 | openSUSE-SU-2025:15157-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dnsdist | 1.9.9-r0 | — |
| Alpine v3.23 | dnsdist | 1.9.9-r0 | — |
| Alpine v3.22 | dnsdist | 1.9.9-r0 | — |
| Alpine v3.21 | dnsdist | 1.9.9-r0 | — |
Advisories 3
- openSUSE-SU-2025:15157-1 dnsdist-1.9.10-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01743-1 Security update for dnsdist SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0902 PowerDNS: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 29, 2025