EUVD-2026-45019Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CoreDNS UDP:53 with proxyproto enabled
-
DeliveryCraft PPv2 header with family 0x11
-
ExploitSend single 28-byte datagram
-
ExecutionparseProxyProtocol errors, addr set nil
-
Persistaddr.String() nil deref panics outside recover
-
ImpactCoreDNS process crashes, DNS outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the CoreDNS proxyproto plugin to be enabled and the attacker to be able to send a UDP datagram to the CoreDNS listener; the malicious packet must carry a valid PROXY protocol v2 signature but declare a non-UDP transport family byte (e.g. 0x11 / TCPv4) so that parseProxyProtocol errors and addr is reassigned to nil. The primary limiting factor is that proxyproto is a non-default configuration - CoreDNS instances without this plugin are not vulnerable. Beyond that, no authentication, no user interaction, and no special platform are needed (AV:N/AC:L/PR:N/UI:N); a single crafted 28-byte datagram is sufficient. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is credible for the availability-only impact: a network attacker with no privileges or user interaction sends one small datagram to crash the daemon. The real-world risk is gated by a configuration precondition the CVSS score does not capture - the proxyproto plugin must be explicitly enabled, which is a non-default deployment used mostly behind PROXY-protocol-aware load balancers. There is no EPSS value, KEV entry, or public weaponized exploit supplied, so this is a high-CVSS issue whose practical exposure is narrower than the raw score implies: deployments without proxyproto are unaffected, while those that do enable it face a trivially reliable, low-effort crash. Note the trigger byte sequence is public in the PR test, lowering the barrier to reproduction even though no standalone exploit is circulating. |
| Exploit ScenarioDerived | An attacker who can reach the CoreDNS UDP port of a server running the proxyproto plugin sends a single 28-byte datagram whose PROXY v2 header declares a non-UDP transport family (0x11). Parsing fails, addr becomes nil, and the warning-log call to addr.String() panics outside recovery, terminating the CoreDNS process and taking down DNS resolution. The fixing PR ships a test with the exact crashing bytes, so reproduction is straightforward even without a packaged exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
RemediationAI
Vendor-released patch: 1.14.4 - upgrade CoreDNS to v1.14.4 or later (https://github.com/coredns/coredns/releases/tag/v1.14.4), which changes ReadFrom to log using a preserved peer address instead of the nil-reassigned addr (PR https://github.com/coredns/coredns/pull/8154, commit 60a439dd4febfcd78e3779e952fe3fbf3c16bb1f). If immediate upgrade is not possible, the most direct compensating control is to disable the proxyproto plugin in the Corefile, which fully removes the vulnerable code path but sacrifices real-client-IP visibility for any upstream load balancer relying on PROXY protocol; alternatively restrict the CoreDNS UDP listener so only trusted PROXY-protocol front-ends can reach it (via firewall/NetworkPolicy on port 53/UDP), accepting that any datagram from an allowed source that is malformed can still trigger the crash. Full details are in advisory GHSA-9rvv-m5g5-wc8r.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CoreDNS is a Go-based DNS server that is the default cluster DNS in Kubernetes. The flaw lives in the proxyproto plugin (plugin/pkg/proxyproto/proxyproto.go), which wraps the UDP listener to decode PROXY protocol headers used by upstream load balancers to convey the real client address. On the UDP path, PacketConn.ReadFrom calls parseProxyProtocol on the incoming datagram; when the header advertises a non-UDP transport family (e.g. byte 0x11, which is TCPv4/AF_INET+STREAM) the parse fails and returns a nil readFrom result which is assigned back to addr. The subsequent warning log calls addr.String() on that nil net.Addr, producing the CWE-476 nil pointer dereference. Critically this panic occurs in the ReadFrom read loop, outside the ServeDNS deferred recover(), so it propagates and terminates the whole process rather than a single query.
Know when Coredns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A single unauthenticated remote datagram reliably crashes the process (AV:N/AC:L/PR:N/UI:N) with availability-only impact; the proxyproto config precondition is not a CVSS metric so A:H, C/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.
Executive ViewAI
CoreDNS versions prior to 1.14.4 have a remote denial of service vulnerability affecting DNS infrastructure when the proxyproto plugin is enabled. An unauthenticated attacker can crash the DNS server with a single 28-byte UDP packet, disrupting name resolution services organization-wide until the service is manually restarted.
If the proxyproto plugin is not operationally necessary, disable it immediately on all CoreDNS instances. Implement UDP rate limiting on port 53, restrict inbound DNS queries to known trusted clients via firewall rules, and deploy automated process monitoring with restart capabilities to contain outages. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the serv
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending speciall
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Tim
Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 213
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vend
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS s
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to
Exploit-DB