# CVE-2026-26018: CoreDNS denial of service in loop detection plugin

Source: https://junglewise.ai/threats/cve-2026-26018-coredns-denial-of-service-in-loop-detection-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-26018 · Severity: high · CVSS 7.5 · Published 2026-03-06

CoreDNS, a widely used DNS server and the default for Kubernetes clusters, contains a flaw that allows an attacker to crash the service. By sending a small number of specifically crafted network requests, an attacker can trigger a fatal error that shuts down the DNS server. This can lead to a complete loss of network connectivity and service discovery within a cloud environment, potentially causing widespread application failures.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns), [Red Hat Connectivity Link](https://junglewise.ai/threats/technologies/connectivity-link). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-26018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26018 being exploited in the wild.

**How severe is CVE-2026-26018?** High severity, with a CVSS score of 7.5, published 6 March 2026.

**Which products and versions are affected?** CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2; Red Hat Connectivity Link affected.

**Is there a fix for CVE-2026-26018?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26018 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-26018?** Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.2 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.2
  ```


## Technical details

A denial of service (DoS) vulnerability exists in the CoreDNS 'loop' plugin due to the use of a predictable pseudo-random number generator (PRNG) and an insecure error handling mechanism. The plugin generates a secret query name (qname) using Go's math/rand package seeded with a predictable timestamp (UnixNano). If an attacker can predict or observe this qname (e.g., via logs during a network degradation window), they can send three matching HINFO queries. This triggers a fatal error handler (log.Fatalf) which calls os.Exit(1), immediately terminating the CoreDNS process. The vulnerability is most exploitable during the 30-second self-test window when upstream servers are unreachable. The issue is fixed in CoreDNS version 1.14.2 by switching to crypto/rand for stronger randomness.

## Affected products

- CoreDNS CoreDNS < 1.14.2
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 affected
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 affected
- Red Hat Red Hat Connectivity Link 1 affected

## Identifiers

- CVE-2026-26018
- GHSA-h75p-j8xm-m278
- GO-2026-4635

## Timeline

- 2026-03-06: disclosed
- 2026-03-06: advisory
- 2026-03-06: patched: Fixed in CoreDNS v1.14.2

## References

- [https://github.com/coredns/coredns/releases/tag/v1.14.2](https://github.com/coredns/coredns/releases/tag/v1.14.2)
- [https://github.com/coredns/coredns/security/advisories/GHSA-h75p-j8xm-m278](https://github.com/coredns/coredns/security/advisories/GHSA-h75p-j8xm-m278)
- [https://access.redhat.com/errata/RHSA-2026:25127](https://access.redhat.com/errata/RHSA-2026:25127)
- [https://access.redhat.com/errata/RHSA-2026:8151](https://access.redhat.com/errata/RHSA-2026:8151)
- [https://access.redhat.com/security/cve/CVE-2026-26018](https://access.redhat.com/security/cve/CVE-2026-26018)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2445242](https://bugzilla.redhat.com/show_bug.cgi?id=2445242)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26018.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26018.json)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)