CVE-2025-30187

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-301887.5Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is requir CVE-2025-301897.4When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be us CVE-2025-30197.2KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or ope CVE-2025-301905.4Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the c CVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sens CVE-2025-301927.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. CVE-2025-301937.5In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client CVE-2025-301947.5When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange tha CVE-2025-301957.5An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illega CVE-2025-301966.5Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme CVE-2025-301973.1Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for att CVE-2025-301986.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived