Executive brief
CoreDNS is a widely used DNS server that helps translate human-readable web addresses into IP addresses. A flaw in its DNS-over-QUIC (DoQ) feature allows a remote attacker to crash the server by sending a flood of incomplete requests. This can lead to a total service outage, preventing users and applications from resolving domain names.
Technical details
The CoreDNS DNS-over-QUIC (DoQ) implementation fails to properly bound the backlog of streams when the worker pool is exhausted. Specifically, the server spawns a new goroutine for every accepted stream to wait for a worker token, even if the 'worker_pool_size' limit has been reached. Furthermore, active workers utilize 'io.ReadFull()' without a per-stream read deadline. An attacker can exploit this by opening numerous QUIC streams and sending only a single byte; this pins all available workers (who wait indefinitely for the second byte of the length prefix) and creates an unbounded number of 'waiter' goroutines. This leads to rapid memory exhaustion and an Out-of-Memory (OOM) kill. The issue is fixed in version 1.14.3.
Affected products
- CoreDNS CoreDNS < 1.14.3
Timeline
- 2026-04-22: patched: Version 1.14.3 released
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: CVE published to NVD