CVE-2025-30194 Affecting dnsdist package, versions <1.9.9-r0


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.02% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE321-DNSDIST-9954685
  • published2 May 2025
  • disclosed29 Apr 2025

Introduced: 29 Apr 2025

NewCVE-2025-30194  (opens in a new tab)

How to fix?

Upgrade Alpine:3.21 dnsdist to version 1.9.9-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dnsdist package and not the dnsdist package as distributed by Alpine. See How to fix? for Alpine:3.21 relevant fixed versions and status.

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.9 version.

A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version.

We would like to thank Charles Howes for bringing this issue to our attention.