Which versions of CoreDNS are affected by CVE-2026-32934?

CoreDNS DNS-over-QUIC servers in versions before 1.14.3 are vulnerable to unauthenticated remote denial-of-service attacks that exhaust system memory and crash the service.. A patch is available.

How to fix or mitigate CVE-2026-32934?

Within 24 hours, inventory all CoreDNS instances and identify those running versions prior to 1.14.3, prioritizing production systems. Within 7 days, upgrade all affected CoreDNS installations to version 1.14.3 or later, performing staged deployments starting with non-production environments and validating DNS resolution after each upgrade. Within 30 days, implement firewall rules restricting QUIC (UDP 443) access to CoreDNS to trusted clients only, establish resource monitoring alerts for abnormal goroutine and memory consumption, and document rollback procedures for future patches.

CoreDNS CVE-2026-32934

Q: What is the CVSS score of CVE-2026-32934?

CVE-2026-32934 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27440 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-28 https://github.com/coredns/coredns

GHSA-2wpx-qpw2-g5h5

Denial Of Service

8.7

CVSS 4.0 · Vendor: https://github.com/coredns/coredns

Severity by source

Vendor (https://github.com/coredns/coredns) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network attacker sends partial DoQ frames with no interaction (PR:N/UI:N/AC:L); impact is availability-only OOM/crash (A:H, C:N/I:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/coredns/coredns).

CVSS VectorVendor: https://github.com/coredns/coredns

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:45 vuln.today

Analysis Generated

Jul 24, 2026 - 03:45 vuln.today

Patch available

May 05, 2026 - 21:02 EUVD

CVSS changed

May 05, 2026 - 20:22 NVD

7.5 (HIGH) 8.7 (HIGH)

CVE Published

Apr 28, 2026 - 22:40 github-advisory

HIGH 8.7

CVE Published

Apr 28, 2026 - 22:40 nvd

HIGH 7.5

DescriptionCVE.org

Summary

CoreDNS' DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client that opens many QUIC streams and stalls after sending only 1 byte. Even with a small configured quic { worker_pool_size ... }, CoreDNS still spawns a goroutine per accepted stream (workers + waiters) and active workers can block indefinitely in io.ReadFull() with no per-stream read deadline, enabling unauthenticated remote DoS via memory exhaustion/OOM-kill.

Details

CoreDNS' DoQ server uses a global worker pool (streamProcessPool) to limit concurrent stream processing, but when the pool is full it still spawns a goroutine per accepted stream that waits to acquire a worker token: select { case s.streamProcessPool <- ...: go ...; default: go ... wait for token ... } (core/dnsserver/server_quic.go)

Additionally, the DoQ message framing reads are blocking io.ReadFull() calls with no per-stream read deadline: readDOQMessage() reads the 2-byte length prefix and message body via io.ReadFull() (core/dnsserver/server_quic.go)

This allows an attacker to pin all workers by sending 1 byte (so io.ReadFull() blocks waiting for the second byte of the DoQ length prefix), while also creating an unbounded backlog of goroutines waiting for a worker token.

Note: this appears to be a result of an incomplete fix/regression for CVE-2025-47950 (GHSA-cvx7-x8pj-x2gw).

PoC

Adjust COREDNS_BIN in the PoC to point at right path (see the top-level const definitions for tunables as well)
Run python3 ./doq-dos-repro.py
Expected sample output:

* Start CoreDNS * Corefile: /tmp/vh-f003-doq-mem-regression/Corefile Log: /tmp/vh-f003-doq-mem-regression/coredns.log

* Baseline sample (idle) * rss_kib=49380 go_goroutines=17

* Build + run partial-stream flooder * go: downloading golang.org/x/net v0.43.0 go: downloading golang.org/x/crypto v0.41.0 go: downloading go.uber.org/mock v0.5.2 go: downloading github.com/stretchr/testify v1.11.1 go: downloading golang.org/x/sys v0.35.0 go: downloading github.com/pmezard/go-difflib v1.0.0 go: downloading github.com/davecgh/go-spew v1.1.1 go: downloading gopkg.in/yaml.v3 v3.0.1

* Candidate sample (during attack) * rss_kib=137968 go_goroutines=15557

* Flooder output * opened conns=60 streams_per_conn=256 total_streams=15360

* Wrote results * /tmp/vh-f003-doq-mem-regression/results.json

* OK * DoQ flood caused goroutine/RSS growth despite worker_pool_size.

Impact

Unauthenticated remote DoS on an encrypted DNS transport via goroutine/RSS growth leading to OOM-kill/crash and service outage.

AnalysisAI

Unauthenticated remote denial-of-service in CoreDNS' DNS-over-QUIC (DoQ) server (versions before 1.14.3) lets an attacker exhaust memory and goroutines by opening many QUIC streams and sending only a single byte on each, stalling the DoQ length-prefix read. Because CoreDNS spawns a goroutine per accepted stream even when the configured worker_pool_size is full, and workers block indefinitely in io.ReadFull() with no per-stream read deadline, the process grows unbounded until OOM-kill. Publicly available exploit code exists (a Python reproducer demonstrating goroutine growth from 17 to over 15,000), though EPSS remains low at 0.14%; this stems from an incomplete fix/regression of CVE-2025-47950.

Technical ContextAI

CoreDNS is the CNCF DNS server most widely known as the default cluster DNS for Kubernetes, written in Go (CPE pkg:go/github.com/coredns/coredns). The flaw is in its DoQ transport (core/dnsserver/server_quic.go), which implements DNS-over-QUIC per RFC 9250 using a 2-byte length-prefixed message framing. Two design gaps combine into the CWE-770 (Allocation of Resources Without Limits or Throttling) root cause: first, the streamProcessPool worker pool is meant to bound concurrent stream processing, but when full the server still launches a fresh 'waiter' goroutine for every accepted stream to await a worker token, so backlog is unbounded; second, readDOQMessage() uses blocking io.ReadFull() calls with no per-stream read deadline, so a partial write (1 byte of the 2-byte length prefix) pins a worker indefinitely. Together these let a small number of connections spawn tens of thousands of parked goroutines and drive resident memory up until the kernel OOM-kills the process.

RemediationAI

Upgrade to CoreDNS 1.14.3 or later, the vendor-released patched version (https://github.com/coredns/coredns/releases/tag/v1.14.3), which avoids spawning waiter goroutines when the QUIC worker pool is full (PR #7927) and is the primary fix. If you cannot patch immediately, the most effective compensating control is to disable the DoQ transport by removing the quic{} block from your Corefile and serving DNS over conventional UDP/TCP, DoT, or DoH instead - this fully removes the attack surface at the cost of losing DNS-over-QUIC support for clients that rely on it. Where DoQ must remain enabled, restrict reachability of the QUIC/UDP port (default 853) with network ACLs or firewall rules so only trusted resolvers/clients can open QUIC streams, accepting that this only limits rather than eliminates the goroutine/memory growth. Consult SUSE and Red Hat advisories for distribution-packaged fixed builds. Vendor advisory: https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5.