Coredns
Monthly
Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 2136 dynamic-update messages into an upstream nameserver in CoreDNS versions prior to 1.14.7. The DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC code paths unpack queries without applying dns.DefaultMsgAcceptFunc, so they accept an opcode UPDATE that UDP, TCP, and DoT reject; when CoreDNS is running the proxy or forward plugin against an update-capable upstream that trusts CoreDNS's source address and does not require an attacker-unknown end-to-end TSIG, the UPDATE appears to come from CoreDNS itself and can add, replace, or delete records, hijack names, or alter mail routing in the writable zone. Exploitation is unauthenticated with no user interaction and no public exploit identified at time of analysis, but the exposed CVSS 7.5 (AV:N/AC:L) figure overstates practical reach: the assessed vector raises the bar to AC:H and S:C because the attacker must also find an update-capable upstream that trusts CoreDNS without TSIG enforcement, which substantially narrows the real attack surface.
Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the server by sending crafted queries over the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC transports. Those request paths call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header, so name compression and excessive section counts amplify allocation ahead of the plugin chain, meaning plugin-level rate limiting cannot stop concurrent requests from exhausting memory. There is no public exploit identified at time of analysis, but the flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is only reachable when one of those non-default transports is enabled - deployments using only the ordinary UDP and TCP listeners are not affected.
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending specially crafted DNS queries (CVSS 7.5).
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS server by sending a single ordinary DNS query. The rewrite plugin's edns0 response rules dereference the result of IsEdns0() without a nil check; when a downstream plugin returns a response lacking an OPT record, the ResponseReverter panics, returning SERVFAIL in default deployments or terminating the CoreDNS process entirely when the debug directive is active. No public exploit code has been identified and the issue is fixed in v1.14.5.
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Time-of-Use race condition in the plugin execution chain, where the rewrite plugin processes requests after security plugins like ACL have already validated them. An attacker with network access can exploit this logical flaw to access DNS records that should be restricted by configured access control policies. No patch is currently available for affected deployments.
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limit...
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Unauthenticated DNS UPDATE injection through CoreDNS's encrypted and gRPC listeners lets a remote client smuggle RFC 2136 dynamic-update messages into an upstream nameserver in CoreDNS versions prior to 1.14.7. The DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC code paths unpack queries without applying dns.DefaultMsgAcceptFunc, so they accept an opcode UPDATE that UDP, TCP, and DoT reject; when CoreDNS is running the proxy or forward plugin against an update-capable upstream that trusts CoreDNS's source address and does not require an attacker-unknown end-to-end TSIG, the UPDATE appears to come from CoreDNS itself and can add, replace, or delete records, hijack names, or alter mail routing in the writable zone. Exploitation is unauthenticated with no user interaction and no public exploit identified at time of analysis, but the exposed CVSS 7.5 (AV:N/AC:L) figure overstates practical reach: the assessed vector raises the bar to AC:H and S:C because the attacker must also find an update-capable upstream that trusts CoreDNS without TSIG enforcement, which substantially narrows the real attack surface.
Memory-exhaustion denial of service in CoreDNS prior to 1.14.7 lets a remote unauthenticated attacker terminate the server by sending crafted queries over the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC transports. Those request paths call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header, so name compression and excessive section counts amplify allocation ahead of the plugin chain, meaning plugin-level rate limiting cannot stop concurrent requests from exhausting memory. There is no public exploit identified at time of analysis, but the flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is only reachable when one of those non-default transports is enabled - deployments using only the ordinary UDP and TCP listeners are not affected.
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending specially crafted DNS queries (CVSS 7.5).
Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS server by sending a single ordinary DNS query. The rewrite plugin's edns0 response rules dereference the result of IsEdns0() without a nil check; when a downstream plugin returns a response lacking an OPT record, the ResponseReverter panics, returning SERVFAIL in default deployments or terminating the CoreDNS process entirely when the debug directive is active. No public exploit code has been identified and the issue is fixed in v1.14.5.
Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.
CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Time-of-Use race condition in the plugin execution chain, where the rewrite plugin processes requests after security plugins like ACL have already validated them. An attacker with network access can exploit this logical flaw to access DNS records that should be restricted by configured access control policies. No patch is currently available for affected deployments.
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limit...
A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.