Is CVE-2026-82399 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82399 being exploited in the wild.

How severe is CVE-2026-82399?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

CoreDNS v0.0.7 through v1.14.6 (DoH from v1.1.3, DoQ from v1.11.0, DoH3 from v1.13.2); github.com/coredns/coredns (Go) <= 1.14.6, SEMVER:introduced=0,fixed=1.14.7.

Is there a fix for CVE-2026-82399?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82399 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-82399?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82399: CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3

Q: Is there a fix for CVE-2026-82399?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82399 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-82399?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82399 · Severity: high · CVSS 7.5 · Published 2026-09-16

CoreDNS is a popular DNS server used in Kubernetes and other cloud environments. A remote attacker can send specially crafted DNS requests over HTTPS, QUIC, or gRPC to exhaust server memory and crash the service, causing DNS resolution to fail. No authentication or special configuration is required—the attack works against default deployments.

Technologies: CoreDNS, github.com/coredns/coredns (Go). Vendors: CoreDNS, Go.

Quick answers

Is CVE-2026-82399 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82399 being exploited in the wild.
How severe is CVE-2026-82399?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: CoreDNS v0.0.7 through v1.14.6 (DoH from v1.1.3, DoQ from v1.11.0, DoH3 from v1.13.2); github.com/coredns/coredns (Go) <= 1.14.6, SEMVER:introduced=0,fixed=1.14.7.
Is there a fix for CVE-2026-82399?: Yes. github.com/coredns/coredns (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82399 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82399?: Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/coredns/coredns (Go): upgrade to 1.14.7 or later
```
go get github.com/coredns/coredns@v1.14.7
```

Technical details

The vulnerability exists in CoreDNS's DNS-over-HTTPS (DoH, DoH3), DNS-over-QUIC (DoQ), and DNS-over-gRPC transports. These implementations call `dns.Msg.Unpack` directly on attacker-controlled data without first validating section counts against the miekg/dns library's `DefaultMsgAcceptFunc` policy, which the standard UDP/TCP listeners enforce. An attacker can craft a compressed DNS message with inflated question counts (e.g., a 65 KB request with 10,878 questions) that allocates over 10 MiB during unpacking. Sending 32 such concurrent requests exhausts memory and terminates the process. The fix requires applying header validation before unpacking in each custom transport handler.

Affected products

CoreDNS CoreDNS v0.0.7 through v1.14.6 (DoH from v1.1.3, DoQ from v1.11.0, DoH3 from v1.13.2)

Identifiers

CVE-2026-82399
GHSA-mrg3-qvqr-jw29
GO-2026-6507

Timeline

2026-09-17: disclosed
other: CVE-2026-82399 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.