What is the CVSS score of CVE-2026-62299?

CVE-2026-62299 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-62299?

Yes, a patch is available for CVE-2026-62299. Update the affected software to the latest version immediately.

CoreDNS CVE-2026-62299

EUVD-2026-45020 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-16 GitHub_M

Denial Of Service Null Pointer Dereference Coredns Red Hat

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

DNS is network-accessible with no auth or interaction required; A:L reflects the default SERVFAIL outcome, with crash only when non-default debug directive is active.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 16, 2026 - 22:19 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 20:31 vuln.today

Analysis Generated

Jul 16, 2026 - 20:31 vuln.today

CVE Published

Jul 16, 2026 - 19:44 cve.org

MEDIUM 5.3

DescriptionCVE.org

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.

AnalysisAI

Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS server by sending a single ordinary DNS query. The rewrite plugin's edns0 response rules dereference the result of IsEdns0() without a nil check; when a downstream plugin returns a response lacking an OPT record, the ResponseReverter panics, returning SERVFAIL in default deployments or terminating the CoreDNS process entirely when the debug directive is active. No public exploit code has been identified and the issue is fixed in v1.14.5.

Technical ContextAI

CoreDNS (cpe:2.3:a:coredns:coredns) is a Go-based DNS server that serves as the default cluster DNS resolver in Kubernetes. The vulnerability is rooted in CWE-476 (Null Pointer Dereference) and resides in plugin/rewrite/edns0.go within the edns0SetResponseRule and edns0ReplaceResponseRule[T] response rule implementations. Both methods invoke res.IsEdns0(), which returns a *dns.OPT pointer, and immediately dereference that pointer without verifying it is non-nil. When a downstream plugin in the CoreDNS chain produces a DNS response that omits the OPT (EDNS0 extension) record - a valid and common response format - the returned pointer is nil, triggering a Go nil dereference panic. The panic propagates through ResponseReverter in plugin/rewrite/reverter.go, which is invoked during response post-processing when the revert flag is set on an edns0 rewrite rule. The fix in PR #8190 (commit fc447d0658b093edc8cd29a6b171216a44a644c2) inserts explicit nil guards immediately after both IsEdns0() calls, aborting the revert operation cleanly when no OPT record is present.

RemediationAI

Upgrade CoreDNS to version 1.14.5, which contains the nil-guard fix introduced in commit fc447d0658b093edc8cd29a6b171216a44a644c2 via PR #8190; the release is at https://github.com/coredns/coredns/releases/tag/v1.14.5. If an immediate upgrade is not feasible, remove the revert flag from any edns0 rewrite rules in the Corefile (e.g., change 'rewrite edns0 local set 0xffee 0xabcdef revert' to the same rule without 'revert'); note that this changes behavior - EDNS0 options added during request rewriting will no longer be stripped from responses, which may affect downstream clients expecting clean responses. As a secondary measure, removing the debug directive from the Corefile (if present) limits the worst-case outcome from process termination to SERVFAIL responses, buying time without fully eliminating the vulnerability.