What is the CVSS score of CVE-2026-26018?

CVE-2026-26018 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-26018?

Yes, a public proof-of-concept exploit is available for CVE-2026-26018. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26018?

Within 24 hours: Inventory all CoreDNS deployments and identify instances running versions 1.14.2 or earlier; validate current version in production. Within 7 days: Implement network-based rate limiting and query filtering to reduce attack surface; isolate CoreDNS infrastructure where possible; establish monitoring for abnormal DNS query patterns. Within 30 days: Subscribe to CoreDNS security advisories and prepare deployment procedures for immediate patching upon release; consider temporary migration to alternative DNS solutions if organizational risk tolerance is low.

Coredns CVE-2026-26018

HIGH

Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)

2026-03-06 security-advisories@github.com

GHSA-h75p-j8xm-m278

Denial Of Service Coredns Coredns Io

7.5

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft DNS query exploiting predictable PRNG
Exploit

Trigger loop detection plugin
Impact

Fatal error handler crashes CoreDNS process

Vulnerability Assessment

Weakness	CWE CWE-337 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Unpredictable PRNG seeds
Exploitation Conditions	CoreDNS versions prior to 1.14.2 with loop detection plugin enabled. Attacker sends specially crafted DNS queries to the listening DNS port. No authentication required; default configurations vulnerable to remote unauthenticated DoS attacks.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to crash the DNS server by sending specially crafted DNS queries.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending specially crafted DNS queries (CVSS 7.5).

RemediationAI

Fixed in version 1.14.2.. Restrict network access to the affected service where possible.

Affected Packages

go github.com/coredns/coredns fix: 1.14.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

affects Coredns. CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

Know when Coredns gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 09, 2026 - 20:32 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

Executive ViewAI

Why It Matters

CoreDNS versions up to 1.14.2 are vulnerable to denial-of-service attacks that could crash DNS infrastructure, disrupting critical services dependent on name resolution. Organizations running affected versions face immediate risk of service unavailability until patching is available.

Business Impact: High

Compensating Controls

Implement DNS query rate limiting and firewall rules to restrict large volumes of malformed DNS queries; deploy Web Application Firewall (WAF) or DNS firewall appliances to filter anomalous query patterns; enable detailed DNS logging and alerting for crash indicators; segment DNS infrastructure from critical services; configure DNS query size restrictions and timeout policies; maintain DNS failover capacity to alternate providers or secondary nameservers.

Threat Intelligence Overview

EPSS Score

0.1%

Top 84% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*

Related Vulnerabilities in CoreDNS Access Control Bypass

View all 2

CVE-2026-26017 MEDIUM POC

6.3

More in Coredns

View all

CVE-2026-82399 HIGH This Week POC

7.5 Sep 16

Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the serv

CVE-2026-86003 HIGH This Week

7.5 Sep 16

Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 213

CVE-2026-62309 HIGH This Week

7.5 Jul 16

Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server

CVE-2025-47950 HIGH This Week

7.5 Jun 06

A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vend

CVE-2025-68151 MEDIUM This Month

6.6 Jan 08

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT

CVE-2026-62299 MEDIUM This Month

5.3 Jul 16

Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS s

CVE-2026-62994 LOW Monitor

3.7 Jul 16

Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to

Same weakness CWE-337 – Predictable Seed in Pseudo-Random Number Generator (PRNG)

View all

CVE-2024-7558 HIGH POC

8.0

CVE-2022-26852 CRITICAL

9.8

7.6

8.7

7.8

7.7

7.5

CVE-2025-62710 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed

References

Advisories & patches

ADVISORY https://vuldb.com/vuln/349500 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1042/ REF https://access.redhat.com/errata/RHSA-2026:25127 REF https://access.redhat.com/errata/RHSA-2026:36873 REF https://access.redhat.com/errata/RHSA-2026:8151 REF https://access.redhat.com/security/cve/CVE-2026-26018 REF https://bugzilla.redhat.com/show_bug.cgi?id=2445242 REF https://github.com/coredns/coredns/releases/tag/v1.14.2 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26018.json

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back