Nil-pointer dereference in CoreDNS proxyproto plugin (CVE-2026-62309)

CVE-2026-62309 is a nil-pointer dereference (CWE-476) in CoreDNS's proxyproto plugin that allows any unauthenticated remote attacker to kill the CoreDNS process with a single 28-byte UDP datagram. A PROXY v2 header carrying a non-UDP transport family causes `PacketConn.ReadFrom` in `plugin/pkg/proxyproto/proxyproto.go` to dereference a nil address before the per-request recovery handler applies, resulting in process termination (exit code 2) and a denial-of-service condition. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). Affected versions: - <=1.14.4 We recommend updating to: 1.14.5. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/coredns/coredns/security/advisories/GHSA-9rvv-m5g5-wc8r Details: https://vuln.today/cve/CVE-2026-62309