Is CVE-2026-32934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32934 being exploited in the wild.

How severe is CVE-2026-32934?

High severity, with a CVSS score of 7.5, published 5 May 2026.

Which products and versions are affected?

CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

Is there a fix for CVE-2026-32934?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32934 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-32934?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32934: CoreDNS resource exhaustion in DNS-over-QUIC server

Q: Which products and versions are affected?

CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

Q: Is there a fix for CVE-2026-32934?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32934 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-32934?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32934 · Severity: high · CVSS 7.5 · Published 2026-05-05

CoreDNS is a widely used DNS server that helps translate human-readable web addresses into IP addresses. A flaw in its DNS-over-QUIC (DoQ) feature allows a remote attacker to crash the server by sending a flood of incomplete requests. This can lead to a total service outage, preventing users and applications from resolving domain names.

Technologies: CoreDNS, github.com/coredns/coredns (Go). Vendors: CoreDNS, Go.

Quick answers

Is CVE-2026-32934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32934 being exploited in the wild.
How severe is CVE-2026-32934?: High severity, with a CVSS score of 7.5, published 5 May 2026.
Which products and versions are affected?: CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.
Is there a fix for CVE-2026-32934?: Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32934 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-32934?: Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/coredns/coredns (Go): upgrade to 1.14.3 or later
```
go get github.com/coredns/coredns@v1.14.3
```

Technical details

The CoreDNS DNS-over-QUIC (DoQ) implementation fails to properly bound the backlog of streams when the worker pool is exhausted. Specifically, the server spawns a new goroutine for every accepted stream to wait for a worker token, even if the 'worker_pool_size' limit has been reached. Furthermore, active workers utilize 'io.ReadFull()' without a per-stream read deadline. An attacker can exploit this by opening numerous QUIC streams and sending only a single byte; this pins all available workers (who wait indefinitely for the second byte of the length prefix) and creates an unbounded number of 'waiter' goroutines. This leads to rapid memory exhaustion and an Out-of-Memory (OOM) kill. The issue is fixed in version 1.14.3.

Affected products

CoreDNS CoreDNS < 1.14.3

Identifiers

CVE-2026-32934
GHSA-2wpx-qpw2-g5h5
GO-2026-4969

Timeline

2026-04-22: patched: Version 1.14.3 released
2026-04-25: advisory: GitHub Security Advisory published
2026-05-05: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.