In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8037-1 advisory.

    It was discovered that HTTP/2, which is used/vendored by DNSdist, did not properly account for resources     when handling client-triggered stream

    resets. An attacker could possibly use this issue to cause a

    denial of service. (CVE-2025-8671)

    It was discovered that DNSdist did not properly manage memory limits when handling an unlimited number of     queries on a single TCP connection. An

    attacker could possibly use this issue to cause a denial of service. (CVE-2025-30193)

    It was discovered that DNSdist, when configured with the nghttp2 library, did not correctly process     certain DNS over HTTPS queries. An attacker could possibly use this cause a denial of service.
    (CVE-2025-30187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0f0623b719 advisory.

    Update to 1.9.11 to fix CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b6c24f05eb advisory.

    Update to 1.9.11 to fix CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5cef5ecca3 advisory.

    Update to 2.0.1 to CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c2253bff-9952-11f0-b6e2-6805ca2fa271 advisory.

    security@open-xchange.com reports:
    In some circumstances, when DNSdist is configured to use the nghttp2                  library to process incoming DNS over HTTPS queries, an attacker                  might be able to cause a denial of service by crafting a DoH exchange                  that triggers an unbounded I/O read loop, causing an unexpected                  consumption of CPU resources. The offending code was introduced in                  DNSdist 1.9.0-alpha1 so previous versions are not affected.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over     HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that     triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources. (CVE-2025-30187)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299040	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : DNSdist vulnerabilities (USN-8037-1)	Nessus	Ubuntu Local Security Checks	high
266375	Fedora 41 : dnsdist (2025-0f0623b719)	Nessus	Fedora Local Security Checks	low
266369	Fedora 42 : dnsdist (2025-b6c24f05eb)	Nessus	Fedora Local Security Checks	low
266314	Fedora 43 : dnsdist (2025-5cef5ecca3)	Nessus	Fedora Local Security Checks	low
265816	FreeBSD : dnsdist -- Denial of service via crafted DoH exchange (c2253bff-9952-11f0-b6e2-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	low
265571	Linux Distros Unpatched Vulnerability : CVE-2025-30187	Nessus	Misc.	low

Detections

Analytics

CVE-2025-30187

low

Tenable Plugins

high

low

low

low

low

low