Executive brief
CoreDNS is a popular open-source DNS server used to translate human-readable domain names into IP addresses. A flaw in its 'rewrite' plugin allows a remote attacker to send a specially crafted DNS query that causes the server to encounter an internal error. In most cases, this results in the server failing to answer the request (returning a SERVFAIL error), but if specific debugging features are enabled, it can cause the entire DNS service to crash, leading to a service outage.
Technical details
A NULL pointer dereference exists in the CoreDNS 'rewrite' plugin within the edns0SetResponseRule and edns0ReplaceResponseRule components. When a rewrite rule uses the 'revert' flag, the plugin attempts to restore EDNS0 options in the response; however, it fails to verify if an OPT record exists before dereferencing the pointer returned by res.IsEdns0(). An unauthenticated remote attacker can trigger this by sending a DNS query that matches a 'rewrite edns0 ... revert' rule when the downstream plugin returns a response without an OPT record (common in authoritative replies). This results in a Go panic; while usually caught by the server's recovery handler (resulting in SERVFAIL), it will crash the process if the 'debug' directive is enabled. The issue is fixed in version 1.14.5.
Affected products
- CoreDNS CoreDNS < 1.14.5
Timeline
- 2026-06-23: patched: Fix merged into master branch
- 2026-07-10: advisory: Version 1.14.5 released
- 2026-07-16: disclosed: CVE-2026-62299 published