CVE-2024-25581 - CVE House
Back to Database
Status published High CVE-2024-25581

Transfer requests received over DoH can lead to a denial of service in DNSdist

Vulnerability Description

When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25581

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Daniel Stirnimann from Switch

References

More from PowerDNS

View All →
CVE-2025-59030
Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
High 7.5
CVE-2025-59029
Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
Medium 5.3
CVE-2025-59024
Crafted delegations or IP fragments can poison cached delegations in Recursor
Medium 6.5
CVE-2025-59023
Crafted delegations or IP fragments can poison cached delegations in Recursor
High 8.2
CVE-2025-30195
A crafted zone can lead to an illegal memory access in the PowerDNS Recursor
High 7.5

Affected Vendor

Affected Software

DNSdist
Vulnerable Versions:
1.9.0, 1.9.1, 1.9.2, 1.9.3

Timeline

Official Publish: May 13th, 2024
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact