Description: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. Impact: By flooding a target resolver with HTTP/2 traffic and exploiting this flaw, an attacker could overwhelm the server, causing high CPU and/or memory usage and preventing other clients from establishing DoH connections. This would significantly impair the resolver's performance and effectively deny legitimate clients access to the DNS resolution service. Authoritative servers are affected by this vulnerability. Resolvers are affected by this vulnerability. Versions affected: 9.18.0 -> 9.18.32 9.20.0 -> 9.20.4 9.21.0 -> 9.21.3 (Versions prior to 9.18.27 were not assessed.)
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:1670 https://access.redhat.com/errata/RHSA-2025:1670
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:1907 https://access.redhat.com/errata/RHSA-2025:1907