CVE-2026-26018: CoreDNS denial of service in loop detection plugin

CVE-2026-26018 · Severity: high · CVSS 7.5 · Published 2026-03-06

CoreDNS, a widely used DNS server and the default for Kubernetes clusters, contains a flaw that allows an attacker to crash the service. By sending a small number of specifically crafted network requests, an attacker can trigger a fatal error that shuts down the DNS server. This can lead to a complete loss of network connectivity and service discovery within a cloud environment, potentially causing widespread application failures.

Technologies: CoreDNS, github.com/coredns/coredns (Go), Red Hat Connectivity Link. Vendors: CoreDNS, Go, Red Hat.

Quick answers

Is CVE-2026-26018 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26018 being exploited in the wild.
How severe is CVE-2026-26018?
High severity, with a CVSS score of 7.5, published 6 March 2026.
Which products and versions are affected?
CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2; Red Hat Connectivity Link affected.
Is there a fix for CVE-2026-26018?
Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26018 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-26018?
Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coredns/coredns (Go): upgrade to 1.14.2 or later
    go get github.com/coredns/coredns@v1.14.2

Technical details

A denial of service (DoS) vulnerability exists in the CoreDNS 'loop' plugin due to the use of a predictable pseudo-random number generator (PRNG) and an insecure error handling mechanism. The plugin generates a secret query name (qname) using Go's math/rand package seeded with a predictable timestamp (UnixNano). If an attacker can predict or observe this qname (e.g., via logs during a network degradation window), they can send three matching HINFO queries. This triggers a fatal error handler (log.Fatalf) which calls os.Exit(1), immediately terminating the CoreDNS process. The vulnerability is most exploitable during the 30-second self-test window when upstream servers are unreachable. The issue is fixed in CoreDNS version 1.14.2 by switching to crypto/rand for stronger randomness.

Affected products

  • CoreDNS CoreDNS < 1.14.2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 affected
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 affected
  • Red Hat Red Hat Connectivity Link 1 affected

Identifiers

  • CVE-2026-26018
  • GHSA-h75p-j8xm-m278
  • GO-2026-4635

Timeline

  • 2026-03-06: disclosed
  • 2026-03-06: advisory
  • 2026-03-06: patched: Fixed in CoreDNS v1.14.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.