In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0f0623b719 advisory.

    Update to 1.9.11 to fix CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b6c24f05eb advisory.

    Update to 1.9.11 to fix CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5cef5ecca3 advisory.

    Update to 2.0.1 to CVE-2025-30187

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c2253bff-9952-11f0-b6e2-6805ca2fa271 advisory.

    security@open-xchange.com reports:
    In some circumstances, when DNSdist is configured to use the nghttp2                  library to process incoming DNS over HTTPS queries, an attacker                  might be able to cause a denial of service by crafting a DoH exchange                  that triggers an unbounded I/O read loop, causing an unexpected                  consumption of CPU resources. The offending code was introduced in                  DNSdist 1.9.0-alpha1 so previous versions are not affected.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over     HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that     triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources. (CVE-2025-30187)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
266375	Fedora 41 : dnsdist (2025-0f0623b719)	Nessus	Fedora Local Security Checks	low
266369	Fedora 42 : dnsdist (2025-b6c24f05eb)	Nessus	Fedora Local Security Checks	low
266314	Fedora 43 : dnsdist (2025-5cef5ecca3)	Nessus	Fedora Local Security Checks	low
265816	FreeBSD : dnsdist -- Denial of service via crafted DoH exchange (c2253bff-9952-11f0-b6e2-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	low
265571	Linux Distros Unpatched Vulnerability : CVE-2025-30187	Nessus	Misc.	low

Detections

Analytics

CVE-2025-30187

low

Tenable Plugins

low

low

low

low

low