EUVD-2026-45019Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A single unauthenticated remote datagram reliably crashes the process (AV:N/AC:L/PR:N/UI:N) with availability-only impact; the proxyproto config precondition is not a CVSS metric so A:H, C/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.
AnalysisAI
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
Technical ContextAI
CoreDNS is a Go-based DNS server that is the default cluster DNS in Kubernetes. The flaw lives in the proxyproto plugin (plugin/pkg/proxyproto/proxyproto.go), which wraps the UDP listener to decode PROXY protocol headers used by upstream load balancers to convey the real client address. On the UDP path, PacketConn.ReadFrom calls parseProxyProtocol on the incoming datagram; when the header advertises a non-UDP transport family (e.g. byte 0x11, which is TCPv4/AF_INET+STREAM) the parse fails and returns a nil readFrom result which is assigned back to addr. The subsequent warning log calls addr.String() on that nil net.Addr, producing the CWE-476 nil pointer dereference. Critically this panic occurs in the ReadFrom read loop, outside the ServeDNS deferred recover(), so it propagates and terminates the whole process rather than a single query.
RemediationAI
Vendor-released patch: 1.14.4 - upgrade CoreDNS to v1.14.4 or later (https://github.com/coredns/coredns/releases/tag/v1.14.4), which changes ReadFrom to log using a preserved peer address instead of the nil-reassigned addr (PR https://github.com/coredns/coredns/pull/8154, commit 60a439dd4febfcd78e3779e952fe3fbf3c16bb1f). If immediate upgrade is not possible, the most direct compensating control is to disable the proxyproto plugin in the Corefile, which fully removes the vulnerable code path but sacrifices real-client-IP visibility for any upstream load balancer relying on PROXY protocol; alternatively restrict the CoreDNS UDP listener so only trusted PROXY-protocol front-ends can reach it (via firewall/NetworkPolicy on port 53/UDP), accepting that any datagram from an allowed source that is malformed can still trigger the crash. Full details are in advisory GHSA-9rvv-m5g5-wc8r.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending speciall
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Tim
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vend
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS s
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today