What is the CVSS score of CVE-2026-62994?

CVE-2026-62994 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-62994?

Yes, a patch is available for CVE-2026-62994. Update the affected software to the latest version immediately.

CoreDNS CVE-2026-62994

EUVD-2026-45018 LOW

Uncaught Exception (CWE-248)

2026-07-16 GitHub_M

Information Disclosure Kubernetes Coredns

3.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

AXFR request is network-delivered with no auth, AC:H reflects multi-condition prerequisite; A:L as Kubernetes restarts CoreDNS pod; no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 16, 2026 - 22:19 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 20:22 vuln.today

Analysis Generated

Jul 16, 2026 - 20:22 vuln.today

CVE Published

Jul 16, 2026 - 19:39 cve.org

LOW 3.7

DescriptionCVE.org

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.

AnalysisAI

Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.

Technical ContextAI

CoreDNS is a Go-based DNS server that serves as the default cluster DNS in most Kubernetes deployments. The vulnerability arises from a missing bounds check across three plugin layers: plugin/kubernetes/object/endpoint.go synthesizes Port: -1 for Kubernetes headless service endpoints that declare no ports; plugin/k8s_external/msg_to_dns.go skips such services during DNS record construction, emitting an empty []dns.RR slice into the transfer channel; plugin/k8s_external/transfer.go forwards that empty batch without sanitization; and plugin/transfer/transfer.go dereferences records[0] before verifying the slice is non-empty, triggering a Go index-out-of-bounds panic. CWE-248 (Uncaught Exception) is the root cause class - the runtime panic is unrecovered. The fix (PR #8207, commit ab318db) inserts a single guard (if len(records) == 0 { continue }) at the indexing site. Affected CPE: cpe:2.3:a:coredns:coredns:*:*:*:*:*:*:*:* versions 1.9.4 through 1.14.4.

RemediationAI

Upgrade CoreDNS to version 1.14.5, confirmed fixed per the vendor release at https://github.com/coredns/coredns/releases/tag/v1.14.5 and fix commit ab318db7b4a3a19273852ed627f54888198c8efb. If immediate upgrade is not possible, two compensating controls exist: (1) Restrict AXFR permissions in the CoreDNS transfer plugin configuration to only trusted sources - this removes the external attack surface but may break legitimate zone-transfer consumers such as secondary DNS servers or monitoring tools; (2) Audit Kubernetes headless services and ensure all declare at least one port - this eliminates the triggering Kubernetes state but cannot be enforced reliably in dynamic environments where new workloads may introduce portless services. The upstream fix PR is at https://github.com/coredns/coredns/pull/8207.