Coredns.io vulnerabilities

Products

• Coredns 16

Newest

• coredns CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record CVE-2026-62299 Fix available 5.3 MediumJuly 16, 2026
• coredns CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS CVE-2026-62309 7.5 HighJuly 16, 2026
• coredns CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin CVE-2026-62994 Fix available 3.7 LowJuly 16, 2026
• coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 more CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports CVE-2026-35579 Fix available 8.2 HighApril 28, 2026
• coredns CoreDNS TSIG authentication bypass on encrypted DNS transports CVE-2026-33190 Fix available 8.7 HighApril 28, 2026
• coredns CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison CVE-2026-33489 Fix available 8.2 HighApril 28, 2026
• coredns CoreDNS DoH GET path missing size validation causes CPU and memory amplification CVE-2026-32936 Fix available 8.7 HighApril 28, 2026
• coredns CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service CVE-2026-32934 Fix available 8.7 HighApril 28, 2026
• coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 more CoreDNS ACL Bypass CVE-2026-26017 Fix available 7.7 HighMarch 6, 2026
• coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 more CoreDNS Loop Detection Denial of Service Vulnerability CVE-2026-26018 Fix available 7.5 HighMarch 6, 2026
• coredns CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages CVE-2025-68151 Fix available 6.6 MediumJanuary 8, 2026
• coredns CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification CVE-2025-47950 Fix available 7.5 HighJune 6, 2025
• coredns.io coredns CoreDNS Cache Poisoning via a birthday attack CVE-2023-30464 Fix available 7.5 HighSeptember 18, 2024
• coredns.io coredns CoreDNS vulnerable to TuDoor Attacks CVE-2023-28452 Fix available 7.5 HighSeptember 18, 2024
• coredns coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2837 6.1 MediumMarch 3, 2023
• coredns coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2835 4.4 MediumMarch 3, 2023