{"id":"CVE-2023-30464","aliases":["EUVD-2024-2810","GHSA-h92q-fgpp-qhrq","GO-2024-3134","OESA-2026-4018","openSUSE-SU-2024:0319-1"],"status":"published","title":"CoreDNS Cache Poisoning via a birthday attack","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00408,"percentile":0.35421,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2024-09-18T00:00:00Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Go","package":"github.com/coredns/coredns","fixed_in":["1.11.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.10.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coredns/coredns","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.10.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.10.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.7.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.9.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-bp156.4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-bp156.4.3.1"}]}],"bundled":6}],"products":[{"vendor":"coredns.io","product":"coredns"}],"references":[{"url":"https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30464","tags":["advisory"]},{"url":"https://github.com/coredns/coredns/commit/604a902e2c7e0317aecaa3666124079c75a31573","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-h92q-fgpp-qhrq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30464.json","tags":["advisory"]},{"url":"https://github.com/coredns/coredns","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32936","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2JLUFKCHWHJJ2MQ6XRREF7D4OOWB23V2/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22189","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-30464","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T00:00:00Z","modified":"2024-09-19T18:19:03.084Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2024-2810","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T00:00:00Z","modified":"2024-09-19T18:19:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:18.665654Z"}],"ghsa":[{"id":"GHSA-h92q-fgpp-qhrq","title":"CoreDNS Cache Poisoning via a birthday attack","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T21:30:48Z","modified":"2026-06-05T21:31:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2023-30464","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T21:15:13.08Z","modified":"2026-06-17T05:54:46.283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"CVE-2023-30464","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T00:00:00Z","modified":"2026-10-28T02:30:41.028517967Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-h92q-fgpp-qhrq","title":"CoreDNS Cache Poisoning via a birthday attack","description":"CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-18T21:30:48Z","modified":"2026-09-10T03:50:18.186735635Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"OESA-2026-4018","title":"coredns security update","description":"CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.(CVE-2023-28452)\n\nCoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.(CVE-2023-30464)\n\nCoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.(CVE-2026-32936)","status":"published","published":"2026-09-25T01:27:22Z","modified":"2026-09-25T01:45:03.624201082Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"GO-2024-3134","title":"CoreDNS Cache Poisoning via a birthday attack in github.com/coredns/coredns","description":"CoreDNS enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.","status":"published","published":"2024-09-25T17:43:58Z","modified":"2026-02-04T04:26:57.501234Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:0319-1","title":"Security update for coredns","description":"This update for coredns fixes the following issues:\n\nUpdate to version 1.11.3:\n\n  * optimize the performance for high qps (#6767)\n  * bump deps\n  * Fix zone parser error handling (#6680)\n  * Add alternate option to forward plugin (#6681)\n  * fix: plugin/file: return error when parsing the file fails (#6699)\n  * [fix:documentation] Clarify autopath README (#6750)\n  * Fix outdated test (#6747)\n  * Bump go version from 1.21.8 to 1.21.11 (#6755)\n  * Generate zplugin.go correctly with third-party plugins (#6692)\n  * dnstap: uses pointer receiver for small response writer (#6644)\n  * chore: fix function name in comment (#6608)\n  * [plugin/forward] Strip local zone from IPV6 nameservers (#6635)\n- fixes CVE-2023-30464\n- fixes CVE-2023-28452\n\nUpdate to upstream head (git commit #5a52707):\n\n  * bump deps to address security issue CVE-2024-22189\n  * Return RcodeServerFailure when DNS64 has no next plugin (#6590)\n  * add plusserver to adopters (#6565)\n  * Change the log flags to be a variable that can be set prior to calling Run (#6546)\n  * Enable Prometheus native histograms (#6524)\n  * forward: respect context (#6483)\n  * add client labels to k8s plugin metadata (#6475)\n  * fix broken link in webpage (#6488)\n  * Repo controlled Go version (#6526)\n  * removed the mutex locks with atomic bool (#6525)\n\nUpdate to version 1.11.2:\n\n  * rewrite: fix multi request concurrency issue in cname rewrite  (#6407)\n  * plugin/tls: respect the path specified by root plugin (#6138)\n  * plugin/auto: warn when auto is unable to read elements of the directory tree (#6333)\n  * fix: make the codeowners link relative (#6397)\n  * plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (#6351)\n  * plugin/cache: key cache on Checking Disabled (CD) bit (#6354)\n  * Use the correct root domain name in the proxy plugin's TestHealthX tests (#6395)\n  * Add PITS Global Data Recovery Services as an adopter (#6304)\n  * Handle UDP responses that overflow with TC bit with test case (#6277)\n  * plugin/rewrite: add rcode as a rewrite option (#6204)\n\n- CVE-2024-0874: coredns: CD bit response is cached and served later\n\n- Update to version 1.11.1:\n\n  * Revert “plugin/forward: Continue waiting after receiving malformed responses\n  * plugin/dnstap: add support for “extra” field in payload\n  * plugin/cache: fix keepttl parsing\n\n- Update to version 1.11.0:\n\n  * Adds support for accepting DNS connections over QUIC (doq).\n  * Adds CNAME target rewrites to the rewrite plugin.\n  * Plus many bug fixes, and some security improvements.\n  * This release introduces the following backward incompatible changes:\n   + In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta, \n     since all supported K8s versions now use Endpointslice.\n   + The bufsize plugin changed its default size limit value to 1232\n   + Some changes to forward plugin metrics.\n\n- Update to version 1.10.1:\n\n  * Corrected architecture labels in multi-arch image manifest\n  * A new plugin timeouts that allows configuration of server listener timeout durations\n  * acl can drop queries as an action\n  * template supports creating responses with extended DNS errors\n  * New weighted policy in loadbalance\n  * Option to serve original record TTLs from cache\n\n- Update to version 1.10.0:\n\n\t* core: add log listeners for k8s_event plugin (#5451)\n\t* core: log DoH HTTP server error logs in CoreDNS format (#5457)\n\t* core: warn when domain names are not in RFC1035 preferred syntax (#5414)\n\t* plugin/acl: add support for extended DNS errors (#5532)\n\t* plugin/bufsize: do not expand query UDP buffer size if already set to a smaller value (#5602)\n\t* plugin/cache: add cache disable option (#5540)\n\t* plugin/cache: add metadata for wildcard record responses (#5308)\n\t* plugin/cache: add option to adjust SERVFAIL response cache TTL (#5320)\n\t* plugin/cache: correct responses to Authenticated Data requests (#5191)\n\t* plugin/dnstap: add identity and version support for the dnstap plugin (#5555)\n\t* plugin/file: add metadata for wildcard record responses (#5308)\n\t* plugin/forward: enable multiple forward declarations (#5127)\n\t* plugin/forward: health_check needs to normalize a specified domain name (#5543)\n\t* plugin/forward: remove unused coredns_forward_sockets_open metric (#5431)\n\t* plugin/header: add support for query modification (#5556)\n\t* plugin/health: bypass proxy in self health check (#5401)\n\t* plugin/health: don't go lameduck when reloading (#5472)\n\t* plugin/k8s_external: add support for PTR requests (#5435)\n\t* plugin/k8s_external: resolve headless services (#5505)\n\t* plugin/kubernetes: make kubernetes client log in CoreDNS format (#5461)\n\t* plugin/ready: reset list of readiness plugins on startup (#5492)\n\t* plugin/rewrite: add PTR records to supported types (#5565)\n\t* plugin/rewrite: fix a crash in rewrite plugin when rule type is missing (#5459)\n\t* plugin/rewrite: fix out-of-index issue in rewrite plugin (#5462)\n\t* plugin/rewrite: support min and max TTL values (#5508)\n\t* plugin/trace : make zipkin HTTP reporter more configurable using Corefile (#5460)\n\t* plugin/trace: read trace context info from headers for DOH (#5439)\n\t* plugin/tsig: add new plugin TSIG for validating TSIG requests and signing responses (#4957)\n\t* core: update gopkg.in/yaml.v3 to fix CVE-2022-28948 \n\t* core: update golang.org/x/crypto to fix CVE-2022-27191 \n\t* plugin/acl: adding a check to parse out zone info \n\t* plugin/dnstap: support FQDN TCP endpoint \n\t* plugin/errors: add stacktrace option to log a stacktrace during panic recovery \n\t* plugin/template: return SERVFAIL for zone-match regex-no-match case \n","status":"published","published":"2024-09-27T14:01:32Z","modified":"2026-02-04T03:04:36.822102Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}