Skip to content
OpenAdvisories
Medium WID-SEC-2026-2271 2 CVEs

CoreDNS: Mehrere Schwachstellen ermöglichen Denial of Service

Published Jul 9, 2026 · Updated Sep 2, 2026 · Revision 3 · de-DE

Vendor: Red Hat Product: Enterprise Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CoreDNS ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

CoreDNS ist ein DNS server.

Vulnerabilities 2

  • High 7.5
    CVE-2026-62309

    CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

    CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP tr…

    coredns coredns
  • Low 3.7
    CVE-2026-62994

    CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

    CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless…

    coredns coredns coredns github.com/coredns/coredns Azure Linux Go

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    CVE-Nummern ergänzt

  3. #1

    Initiale Fassung

References