Vendor
CoreDNS CVE-2026-62994 Denial of Service Vulnerability
1 CVEA vulnerability in CoreDNS, specifically within the `k8s_external` plugin, allows for a denial of service when performing a headless AXFR, as the `k8s_external` plugin can emit an empty transfer batch, which subsequently causes the `transfer` plugin to panic.
CoreDNS: Multiple Vulnerabilities Enable Denial of Service
1 TTP 1 CVEMultiple vulnerabilities exist in CoreDNS that allow a remote, unauthenticated attacker to execute a Denial of Service (DoS) attack against the service, potentially leading to service disruption and unavailability for affected systems utilizing CoreDNS.
CoreDNS DoQ Server Denial-of-Service Vulnerability
2 rules 3 TTPs 1 CVECoreDNS' DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client that opens many QUIC streams and stalls after sending only 1 byte, leading to denial of service in versions before 1.14.3.
CoreDNS TSIG Authentication Bypass Vulnerability
2 rules 1 TTPCoreDNS versions prior to 1.14.3 are vulnerable to TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports, allowing unauthenticated network attackers to bypass authentication and potentially access TSIG-protected zone data or submit dynamic DNS updates.
CoreDNS DoH GET Query Denial-of-Service
2 rules 1 TTPCoreDNS is vulnerable to a denial-of-service attack where processing oversized DNS-over-HTTPS GET requests exhausts resources prior to returning an error.
CoreDNS Transfer Plugin ACL Bypass Vulnerability
2 rules 1 TTPCoreDNS' transfer plugin prior to version 1.14.3 can select the wrong ACL stanza due to lexicographic comparison, leading to unauthorized zone transfers by clients intended to be denied by subzone-specific transfer policies.