# CVE-2026-62994: CoreDNS panic in transfer plugin via k8s_external headless services

Source: https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-62994 · Severity: low · CVSS 3.7 · Published 2026-07-16

CoreDNS is a flexible DNS server often used in Kubernetes environments to manage service discovery. A flaw in how it handles specific Kubernetes service configurations (headless services without ports) can cause the server to crash or return errors when a client requests a zone transfer. While this typically results in a temporary service error, repeated attempts could disrupt DNS availability and clutter system logs.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-62994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62994 being exploited in the wild.

**How severe is CVE-2026-62994?** Low severity, with a CVSS score of 3.7, published 16 July 2026.

**Which products and versions are affected?** CoreDNS >= 1.9.4, < 1.14.5; github.com/coredns/coredns (Go) >= 1.9.4, <= 1.14.4, SEMVER:introduced=1.9.4,fixed=1.14.5.

**Is there a fix for CVE-2026-62994?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62994 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62994?** Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.5 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.5
  ```


## Technical details

A vulnerability exists in CoreDNS where a network DNS client authorized to request AXFR zone transfers can trigger a Go panic. The root cause is a lack of bounds checking in `plugin/transfer/transfer.go`, which attempts to index the first element of a record batch (`records[0]`) without verifying if the batch is empty. This empty batch is produced by the `k8s_external` plugin when it encounters a Kubernetes headless service endpoint with no declared ports (assigned a sentinel value of -1). While CoreDNS typically recovers from this panic and returns a SERVFAIL, it can lead to resource exhaustion or process crashes if the `debug` plugin is enabled or if triggered at high frequency. The issue is fixed in version 1.14.5 by adding length checks to the transfer plugin.

## Affected products

- CoreDNS CoreDNS >= 1.9.4, < 1.14.5

## Identifiers

- CVE-2026-62994
- GHSA-74w3-63xv-x9mv
- GO-2026-6805

## Timeline

- 2026-06-29: other: Fix PR submitted to CoreDNS repository
- 2026-07-09: patched: Fix merged into master branch
- 2026-07-10: advisory: GitHub Security Advisory GHSA-74w3-63xv-x9mv published
- 2026-07-16: disclosed: CVE-2026-62994 published to NVD

## References

- [https://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb](https://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb)
- [https://github.com/coredns/coredns/pull/8207](https://github.com/coredns/coredns/pull/8207)
- [https://github.com/coredns/coredns/releases/tag/v1.14.5](https://github.com/coredns/coredns/releases/tag/v1.14.5)
- [https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv](https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)
- [CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports](https://junglewise.ai/threats/cve-2026-35579-coredns-tsig-authentication-bypass-in-grpc-quic-and-doh)