EUVD-2025-17359
GHSA-cvx7-x8pj-x2gw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.5. EPSS 0.1%. Vendor patch available. |
| Exploit ScenarioDerived | An attacker could send specially crafted requests to versions to cause resource exhaustion or application crash, disrupting service availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Earlier versions of this analysis (1)
CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously
RemediationAI
Apply the vendor-supplied patch immediately.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability type: denial of service. CVSS 7.5 indicates high severity. Affects versions.
Know when Coredns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash - especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: max_streams, which caps the number of concurrent QUIC streams per connection with a default value of 256; and worker_pool_size, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of 1024. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the quic:// block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.
Executive ViewAI
CoreDNS deployments running versions prior to 1.12.2 are vulnerable to a remote denial-of-service attack that can crash DNS services through resource exhaustion. Organizations relying on CoreDNS for DNS resolution-particularly in containerized or Kubernetes environments-face service disruption and potential cascading outages across dependent applications.
Apply vendor patch. If immediate patching is not feasible: (1) Disable DNS-over-QUIC (DoQ) protocol on CoreDNS instances until patched; (2) Implement network segmentation to restrict QUIC traffic (UDP port 853) to trusted sources only; (3) Deploy rate limiting at the network edge to restrict connection streams per source IP; (4) Enable resource limits (memory/CPU quotas) on CoreDNS containers to prevent OOM from affecting other services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the serv
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending speciall
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Tim
Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 213
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS s
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to
Same technique Denial Of Service
View allVendor StatusVendor
Debian
Bug #880676| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
SUSE
Severity: High| Product | Status |
|---|---|
| Container suse/sl-micro/6.0/baremetal-os-container:latest | Affected |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Exploit-DB