CVE-2026-62994: CoreDNS panic in transfer plugin via k8s_external headless services

CVE-2026-62994 · Severity: low · CVSS 3.7 · Published 2026-07-16

CoreDNS is a flexible DNS server often used in Kubernetes environments to manage service discovery. A flaw in how it handles specific Kubernetes service configurations (headless services without ports) can cause the server to crash or return errors when a client requests a zone transfer. While this typically results in a temporary service error, repeated attempts could disrupt DNS availability and clutter system logs.

Technologies: CoreDNS, github.com/coredns/coredns (Go). Vendors: CoreDNS, Go.

Quick answers

Is CVE-2026-62994 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62994 being exploited in the wild.
How severe is CVE-2026-62994?
Low severity, with a CVSS score of 3.7, published 16 July 2026.
Which products and versions are affected?
CoreDNS >= 1.9.4, < 1.14.5; github.com/coredns/coredns (Go) >= 1.9.4, <= 1.14.4, SEMVER:introduced=1.9.4,fixed=1.14.5.
Is there a fix for CVE-2026-62994?
Yes. github.com/coredns/coredns (Go): upgrade to 1.14.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62994 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62994?
Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coredns/coredns (Go): upgrade to 1.14.5 or later
    go get github.com/coredns/coredns@v1.14.5

Technical details

A vulnerability exists in CoreDNS where a network DNS client authorized to request AXFR zone transfers can trigger a Go panic. The root cause is a lack of bounds checking in `plugin/transfer/transfer.go`, which attempts to index the first element of a record batch (`records[0]`) without verifying if the batch is empty. This empty batch is produced by the `k8s_external` plugin when it encounters a Kubernetes headless service endpoint with no declared ports (assigned a sentinel value of -1). While CoreDNS typically recovers from this panic and returns a SERVFAIL, it can lead to resource exhaustion or process crashes if the `debug` plugin is enabled or if triggered at high frequency. The issue is fixed in version 1.14.5 by adding length checks to the transfer plugin.

Affected products

  • CoreDNS CoreDNS >= 1.9.4, < 1.14.5

Identifiers

  • CVE-2026-62994
  • GHSA-74w3-63xv-x9mv
  • GO-2026-6805

Timeline

  • 2026-06-29: other: Fix PR submitted to CoreDNS repository
  • 2026-07-09: patched: Fix merged into master branch
  • 2026-07-10: advisory: GitHub Security Advisory GHSA-74w3-63xv-x9mv published
  • 2026-07-16: disclosed: CVE-2026-62994 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.