Executive brief
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns
Affected products
- Go github.com/coredns/coredns
Junglewise Threat Intelligence
CVE-2025-68151: GO-2026-4289 - CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/c
CVE-2025-68151 · Severity: medium · CVSS 4 · Published 2026-01-12
Technologies: github.com/coredns/coredns (Go). Vendors: Go.
Related threats
- CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in p
- CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths
- CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports
- CoreDNS incorrect authorization in transfer plugin ACL selection
- CoreDNS tsig authentication bypass in encrypted transports