Junglewise Threat Intelligence

CVE-2026-26018: CoreDNS denial of service in loop detection plugin

CVE-2026-26018 · Severity: high · CVSS 7.5 · Published 2026-03-06

Technologies: github.com/coredns/coredns (Go), CoreDNS, Red Hat Connectivity Link. Vendors: Go, Red Hat, CoreDNS.

Executive brief

CoreDNS, a widely used DNS server and the default for Kubernetes clusters, contains a flaw that allows an attacker to crash the service. By sending a small number of specifically crafted network requests, an attacker can trigger a fatal error that shuts down the DNS server. This can lead to a complete loss of network connectivity and service discovery within a cloud environment, potentially causing widespread application failures.

Technical details

A denial of service (DoS) vulnerability exists in the CoreDNS 'loop' plugin due to the use of a predictable pseudo-random number generator (PRNG) and an insecure error handling mechanism. The plugin generates a secret query name (qname) using Go's math/rand package seeded with a predictable timestamp (UnixNano). If an attacker can predict or observe this qname (e.g., via logs during a network degradation window), they can send three matching HINFO queries. This triggers a fatal error handler (log.Fatalf) which calls os.Exit(1), immediately terminating the CoreDNS process. The vulnerability is most exploitable during the 30-second self-test window when upstream servers are unreachable. The issue is fixed in CoreDNS version 1.14.2 by switching to crypto/rand for stronger randomness.

Affected products

  • CoreDNS CoreDNS < 1.14.2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 affected
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 affected
  • Red Hat Red Hat Connectivity Link 1 affected

Timeline

  • 2026-03-06: disclosed
  • 2026-03-06: advisory
  • 2026-03-06: patched: Fixed in CoreDNS v1.14.2

References

Related threats