CVE-2025-30187: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-30187 is a vulnerability discovered in DNSdist's DNS over HTTPS (DoH) implementation. The vulnerability was discovered on August 26, 2025, and publicly disclosed on September 18, 2025. It affects PowerDNS DNSdist versions from 1.9.0 to 1.9.10 and 2.0.0, while versions prior to 1.9.0 and versions 1.9.11 and 2.0.1 are not affected. The vulnerability was introduced in DNSdist 1.9.0-alpha1 (PowerDNS Advisory).

The vulnerability occurs when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries. The issue is classified as CWE-835 (Loop with Unreachable Exit Condition - 'Infinite Loop'). It has been assigned a CVSS v3.1 score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (PowerDNS Advisory).

The vulnerability can lead to a denial of service condition through unexpected CPU resource consumption. When successfully exploited, an attacker can trigger an unbounded I/O read loop, causing the system to consume excessive CPU resources (PowerDNS Advisory).

Two remediation options are available: upgrading to a patched version (1.9.11 or 2.0.1) or switching to the h2o provider instead of using the nghttp2 library (PowerDNS Advisory).