CVE-2024-25581: falha de alta gravidade em PowerDNS DNSdist
Transfer requests received over DoH can lead to a denial of service in DNSdist
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.1%
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
PowerDNS · DNSdistCVEs relacionadas — PowerDNS DNSdist
No mesmo produto, das mais perigosas para as menos.
CVE-2025-30194HIGHDenial of service via crafted DoH exchangeEPSS 2.3%CVE-2026-33598MEDIUMOut-of-bounds read in cache inspection via LuaEPSS 1.1%CVE-2026-24028MEDIUMOut-of-bounds read when parsing DNS packets via LuaEPSS 1.1%CVE-2026-40210MEDIUMOut-of-bounds read in SetMacAddrActionEPSS 0.7%CVE-2026-33602MEDIUMOff-by-one access when processing crafted UDP responsesEPSS 0.7%CVE-2026-40211MEDIUMDenial of service via crafted DoH3 queriesEPSS 0.7%