CVE-2025-30193: Denial of service via crafted TCP exchange
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist, causing a denial of service.
The remedy is: upgrade to the patched 1.9.10 version.
A workaround is to restrict the maximum number of queries on incoming TCP connections to a safe value, like 50, via the setMaxTCPQueriesPerConnection setting.
We would like to thank Renaud Allard for bringing this issue to our attention.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30193?
CVE-2025-30193 is classified as a denial of service vulnerability which can lead to significant disruption of service.
How do I fix CVE-2025-30193?
To mitigate CVE-2025-30193, configure DNSdist to limit the number of queries allowed on a single incoming TCP connection.
Which versions of PowerDNS DNSdist are affected by CVE-2025-30193?
CVE-2025-30193 affects PowerDNS DNSdist versions prior to 1.9.10.
What type of attack does CVE-2025-30193 enable?
CVE-2025-30193 enables attackers to perform a denial of service attack by exhausting the stack through crafted TCP exchanges.
What product is impacted by CVE-2025-30193?
CVE-2025-30193 impacts PowerDNS DNSdist.