CoreDNS CVE-2026-82399

Exploitable only when CoreDNS (prior to 1.14.7) is configured to serve DNS over one of the alternative transports: DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC. Deployments using only the default UDP and TCP listeners are NOT affected because those paths validate the fixed DNS header before unpacking. No authentication or user interaction is required against a reachable vulnerable listener (PR:N/UI:N), and plugin-level rate limiting does not mitigate it because the amplified allocation occurs before the plugin chain. The primary limiting factor is therefore the non-default transport configuration and network reachability of that listener.

This is a genuine, well-substantiated availability issue rather than an inflated high-CVSS number. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with CWE-770 (uncontrolled resource allocation) and the description: an unauthenticated remote client triggers unbounded memory allocation because dns.Msg.Unpack runs on attacker-controlled section counts BEFORE dns.DefaultMsgAcceptFunc validates the fixed header, and this happens before the plugin chain so plugin-level rate limiting cannot mitigate it. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation probability signals are absent - no active exploitation or public exploit can be asserted. The most important nuance the raw 7.5 hides is a configuration gate: only the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners are vulnerable, while the default UDP and TCP listeners validate the header first and are explicitly unaffected. Impact is limited to availability (C:N/I:N) - a memory-exhaustion crash of the CoreDNS process, not code execution or data disclosure. Net: a real, patch-worthy DoS for operators who have enabled encrypted/alternative DNS transports, but lower real-world exposure than the network-unauthenticated 7.5 suggests because those transports are not CoreDNS's default configuration.

An unauthenticated attacker sends crafted DoH/DoH3/DoQ/gRPC requests to a CoreDNS instance that exposes one of those encrypted transports, using DNS name compression and inflated section counts so each message forces large allocations before header validation. Firing many such requests concurrently exhausts process memory and terminates CoreDNS, denying DNS resolution to all downstream clients. No public POC is referenced in the provided data, though the fix commit and advisory make the mechanism reproducible.