Quick answers
- Is CVE-2026-62299 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62299 being exploited in the wild.
- How severe is CVE-2026-62299?
- Medium severity, with a CVSS score of 5.3, published 16 July 2026.
- Which products and versions are affected?
- CoreDNS < 1.14.5.
- Is there a fix for CVE-2026-62299?
- A patch was published on 2026-06-23: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62299 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-62299?
- Check whether you run CoreDNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in the CoreDNS 'rewrite' plugin within the edns0SetResponseRule and edns0ReplaceResponseRule components. When a rewrite rule uses the 'revert' flag, the plugin attempts to restore EDNS0 options in the response; however, it fails to verify if an OPT record exists before dereferencing the pointer returned by res.IsEdns0(). An unauthenticated remote attacker can trigger this by sending a DNS query that matches a 'rewrite edns0 ... revert' rule when the downstream plugin returns a response without an OPT record (common in authoritative replies). This results in a Go panic; while usually caught by the server's recovery handler (resulting in SERVFAIL), it will crash the process if the 'debug' directive is enabled. The issue is fixed in version 1.14.5.
Affected products
- CoreDNS CoreDNS < 1.14.5
Timeline
- 2026-06-23: patched: Fix merged into master branch
- 2026-07-10: advisory: Version 1.14.5 released
- 2026-07-16: disclosed: CVE-2026-62299 published