Cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acoredns.iocoredns/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 23 Jul 2026 07:35:22 +0000CoreDNS CVE-2026-62994 Denial of Service Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-coredns-dos-cve-2026-62994/Thu, 23 Jul 2026 07:35:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-coredns-dos-cve-2026-62994/A vulnerability in CoreDNS, specifically within the `k8s_external` plugin, allows for a denial of service when performing a headless AXFR, as the `k8s_external` plugin can emit an empty transfer batch, which subsequently causes the `transfer` plugin to panic.CVE-2026-62994 details a denial-of-service vulnerability affecting CoreDNS, a widely used DNS server for Kubernetes environments. The vulnerability resides within the k8s_external plugin, specifically when handling authoritative zone transfer (AXFR) requests in a headless configuration. Under certain conditions, this plugin can incorrectly generate and emit an empty transfer batch to the transfer plugin. The transfer plugin, upon receiving this unexpected empty batch, enters a panic state, causing the CoreDNS process to crash. This can lead to service disruption for critical DNS resolution within Kubernetes clusters and other environments relying on CoreDNS. While the advisory does not specify observed exploitation, the nature of a DNS server crash makes it a high-impact issue for availability and reliability. The specific conditions under which the k8s_external plugin emits an empty batch are not fully detailed but relate to specific configurations or data states during an AXFR.

Attack Chain

  1. An attacker or malformed client initiates an authoritative zone transfer (AXFR) request targeting a vulnerable CoreDNS server configured with the k8s_external plugin.
  2. The CoreDNS server receives the AXFR query for a zone that it is authoritative for and is handled by the k8s_external plugin.
  3. The k8s_external plugin, operating in a headless configuration, processes the incoming AXFR request.
  4. Due to an internal logic flaw or specific data conditions, the k8s_external plugin attempts to emit an empty transfer batch in response to the AXFR request.
  5. This empty transfer batch is then passed to the CoreDNS transfer plugin for further processing.
  6. The transfer plugin encounters an unhandled exception or null pointer dereference when attempting to process the unexpected empty transfer batch.
  7. This unhandled exception triggers a panic within the CoreDNS process, leading to an immediate crash of the server.
  8. The CoreDNS server becomes unavailable, resulting in a denial of service for DNS resolution requests until the process is restarted.

Impact

Successful exploitation of CVE-2026-62994 results in a denial of service for the affected CoreDNS server. In Kubernetes environments, this can severely disrupt container networking, service discovery, and external communication, leading to widespread application outages and loss of functionality for all services relying on CoreDNS for name resolution. For other deployments, a crashed CoreDNS instance means DNS resolution failures, making network services unreachable. The impact scales with the criticality of the services relying on the affected DNS server. While the advisory does not specify observed exploitation or targeted sectors, any organization using vulnerable CoreDNS deployments is at risk of significant operational downtime.

Recommendation

  • Patch CVE-2026-62994 by updating CoreDNS to a version that addresses this vulnerability immediately, as indicated by the Microsoft Security Response Center reference.
  • Monitor CoreDNS server logs for sudden, unexpected process terminations or restarts which could indicate a denial-of-service event related to CVE-2026-62994.
]]>lowadvisorycorednsdenial-of-servicekubernetescve