CVE-2025-30192

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.

The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers.

The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-301937.5In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client CVE-2025-301947.5When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange tha CVE-2025-301957.5An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illega CVE-2025-301966.5Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme CVE-2025-301973.1Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for att CVE-2025-301986.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived CVE-2025-301997.2ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insec CVE-2025-30205.4An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the config CVE-2025-302006.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easi CVE-2025-302019.1Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wa CVE-2025-302027.5vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vu CVE-2025-302034.8Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) vi