CVE-2025-30192

Name of the Vulnerable Software and Affected Versions versions prior to the updated version

Description An attacker spoofing responses to ECS-enabled requests sent by the Recursor may succeed. The updated version includes mitigations against spoofing attempts of ECS-enabled queries by chaining ECS-enabled requests and enforcing stricter validation of received responses. The most strict mitigation is enabled when the outgoing.edns subnet harden setting is enabled.

Recommendations Update to the latest version to apply the mitigations. Enable the outgoing.edns subnet harden setting.