Description
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. An unauthenticated client can use DNS name compression and excessive section counts to amplify allocation before the plugin chain, so plugin-level rate limiting cannot prevent concurrent requests from exhausting memory and terminating CoreDNS. The ordinary UDP and TCP listeners are not affected because they validate the header first. This issue is fixed in version 1.14.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| coredns | coredns | < 1.14.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | coredns | 1.11.4-22 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | juicefs-1.3 | 1.3.3-r8 | — |
| Wolfi rolling | k8s_gateway | 1.8.2-r11 | — |
| Wolfi rolling | kubernetes-dns-node-cache | 1.26.8-r20 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/coredns/coredns | < 1.14.7 | 1.14.7 | GHSA-mrg3-qvqr-jw29 |
Advisories 1
- WID-SEC-2026-3104 CoreDNS: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 5, 2026