EUVD-2026-80989Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network reach via alt DNS transports, but success depends on upstream trusting CoreDNS and lacking TSIG (AC:H); confused deputy crosses to the upstream zone authority (S:C), high integrity impact, limited availability.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.
AnalysisAI
Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 2136 dynamic-update messages into an upstream nameserver in CoreDNS versions prior to 1.14.7. The DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC code paths unpack queries without applying dns.DefaultMsgAcceptFunc, so they accept an opcode UPDATE that UDP, TCP, and DoT reject; when CoreDNS is running the proxy or forward plugin against an update-capable upstream that trusts CoreDNS's source address and does not require an attacker-unknown end-to-end TSIG, the UPDATE appears to come from CoreDNS itself and can add, replace, or delete records, hijack names, or alter mail routing in the writable zone. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that CoreDNS (prior to 1.14.7) exposes at least one of the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC listeners (these skip dns.DefaultMsgAcceptFunc, unlike UDP/TCP/DoT), AND that CoreDNS is configured with the proxy or forward plugin pointing at an RFC 2136 update-capable upstream, AND that the upstream trusts CoreDNS's source address/connection while NOT requiring an attacker-unknown end-to-end TSIG. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) frames this as a remotely reachable, unauthenticated integrity flaw, and PR:N/AV:N are consistent with the description (any client speaking DoH/DoH3/DoQ/gRPC to CoreDNS). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to CoreDNS 1.14.7, the vendor-released fix version: the release at https://github.com/coredns/coredns/releases/tag/v1.14.7 contains commit 530b0a5ff2ad68cc0421f10dd93568945cc671c9, which routes all four affected listeners through the new dnsutil.UnpackRequest helper that applies dns.DefaultMsgAcceptFunc and rejects non-QUERY/NOTIFY opcodes such as RFC 2136 UPDATE. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CoreDNS instances and identify any running versions prior to 1.14.7, prioritizing deployments that expose DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC listeners and use the proxy or forward plugin toward update-capable upstream nameservers; disable or restrict those encrypted/gRPC listeners to trusted networks if they are not business-required, and verify that upstream dynamic-update endpoints do not trust CoreDNS's source address without requiring TSIG. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending speciall
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Tim
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vend
Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the serv
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS s
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to
Share
External POC / Exploit Code
Leaving vuln.today