Skip to contentCoredns.io Coredns vulnerabilities
- corednsCoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT recordCVE-2026-62299Fix available5.3 Medium
- corednsCoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoSCVE-2026-623097.5 High
- corednsCoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginCVE-2026-62994Fix available3.7 Low
- coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 moreCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsCVE-2026-35579Fix available8.2 High
- corednsCoreDNS TSIG authentication bypass on encrypted DNS transportsCVE-2026-33190Fix available8.7 High
- corednsCoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparisonCVE-2026-33489Fix available8.2 High
- corednsCoreDNS DoH GET path missing size validation causes CPU and memory amplificationCVE-2026-32936Fix available8.7 High
- corednsCoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of serviceCVE-2026-32934Fix available8.7 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS ACL BypassCVE-2026-26017Fix available7.7 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS Loop Detection Denial of Service VulnerabilityCVE-2026-26018Fix available7.5 High
- corednsCoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagesCVE-2025-68151Fix available6.6 Medium
- corednsCoreDNS Vulnerable to DoQ Memory Exhaustion via Stream AmplificationCVE-2025-47950Fix available7.5 High
- coredns.io corednsCoreDNS Cache Poisoning via a birthday attackCVE-2023-30464Fix available7.5 High
- coredns.io corednsCoreDNS vulnerable to TuDoor AttacksCVE-2023-28452Fix available7.5 High
- corednscoreDNS vulnerable to Improper Restriction of Communication Channel to Intended EndpointsCVE-2022-28376.1 Medium
- corednscoreDNS vulnerable to Improper Restriction of Communication Channel to Intended EndpointsCVE-2022-28354.4 Medium