Executive brief
CoreDNS is a flexible DNS server often used in Kubernetes environments to manage service discovery. A flaw in how it handles specific Kubernetes service configurations (headless services without ports) can cause the server to crash or return errors when a client requests a zone transfer. While this typically results in a temporary service error, repeated attempts could disrupt DNS availability and clutter system logs.
Technical details
A vulnerability exists in CoreDNS where a network DNS client authorized to request AXFR zone transfers can trigger a Go panic. The root cause is a lack of bounds checking in `plugin/transfer/transfer.go`, which attempts to index the first element of a record batch (`records[0]`) without verifying if the batch is empty. This empty batch is produced by the `k8s_external` plugin when it encounters a Kubernetes headless service endpoint with no declared ports (assigned a sentinel value of -1). While CoreDNS typically recovers from this panic and returns a SERVFAIL, it can lead to resource exhaustion or process crashes if the `debug` plugin is enabled or if triggered at high frequency. The issue is fixed in version 1.14.5 by adding length checks to the transfer plugin.
Affected products
- CoreDNS CoreDNS >= 1.9.4, < 1.14.5
Timeline
- 2026-06-29: other: Fix PR submitted to CoreDNS repository
- 2026-07-09: patched: Fix merged into master branch
- 2026-07-10: advisory: GitHub Security Advisory GHSA-74w3-63xv-x9mv published
- 2026-07-16: disclosed: CVE-2026-62994 published to NVD