Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coreDNS — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in coreDNS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses associated with the coreDNS product, specifically focusing on vendor advisories and related vulnerability tags. The collection encompasses a comprehensive range of reported issues, including configuration errors, logic flaws, and potential denial-of-service vectors, covering the time span from the project's initial release to the most recent security bulletin. Visitors can utilize this resource to track the vendor's official advisory history, understand the specific characteristics of the weakness classes affecting the DNS server software, or look up the complete vulnerability timeline for coreDNS to assess historical risk exposure. The data presented here is derived from public disclosures and official security notices, providing a centralized view of the product's security posture without requiring access to multiple disparate sources. By reviewing these entries, security teams and developers can identify patterns in reported defects, correlate findings with their own infrastructure, and prioritize remediation efforts based on the severity and impact of each disclosed issue. This aggregation serves as a factual reference for auditing the long-term security evolution of the coreDNS codebase and its various deployment configurations across different environments.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP CWE-441 7.5 High 2026-09-16
CVE-2026-82399 CoreDNS: Unauthenticated memory exhaustion in custom transports CWE-770 7.5 High 2026-09-16
CVE-2026-62299 CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record CWE-476 5.3 Medium 2026-07-16
CVE-2026-62309 CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS CWE-476 7.5 High 2026-07-16
CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin CWE-248 3.7 Low 2026-07-16
CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports CWE-287 7.4 - 2026-05-05
CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison CWE-863 7.5 - 2026-05-05
CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification CWE-400 7.5 - 2026-05-05
CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service CWE-770 7.5 - 2026-05-05
CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports CWE-303 7.4 - 2026-05-05
CVE-2026-26017 CoreDNS ACL Bypass CWE-367 7.7 High 2026-03-06
CVE-2026-26018 CoreDNS Loop Detection Denial of Service Vulnerability CWE-337 7.5 High 2026-03-06
CVE-2025-68151 CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages CWE-770 7.5 - 2026-01-08
CVE-2025-58063 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion CWE-681 7.1 High 2025-09-09
CVE-2025-47950 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification CWE-770 7.5 High 2025-06-06
CVE-2022-2835 CoreDNS 安全漏洞 CWE-923 4.4 - 2023-03-03
CVE-2022-2837 CoreDNS 输入验证错误漏洞 CWE-923 6.1 - 2023-03-03

All 17 known CVE vulnerabilities affecting coreDNS with full Chinese analysis, references, and POCs where available.