Executive brief
CoreDNS is a popular DNS server used in Kubernetes and other cloud environments. A remote attacker can send specially crafted DNS requests over HTTPS, QUIC, or gRPC to exhaust server memory and crash the service, causing DNS resolution to fail. No authentication or special configuration is required—the attack works against default deployments.
Technical details
The vulnerability exists in CoreDNS's DNS-over-HTTPS (DoH, DoH3), DNS-over-QUIC (DoQ), and DNS-over-gRPC transports. These implementations call `dns.Msg.Unpack` directly on attacker-controlled data without first validating section counts against the miekg/dns library's `DefaultMsgAcceptFunc` policy, which the standard UDP/TCP listeners enforce. An attacker can craft a compressed DNS message with inflated question counts (e.g., a 65 KB request with 10,878 questions) that allocates over 10 MiB during unpacking. Sending 32 such concurrent requests exhausts memory and terminates the process. The fix requires applying header validation before unpacking in each custom transport handler.
Affected products
- CoreDNS CoreDNS v0.0.7 through v1.14.6 (DoH from v1.1.3, DoQ from v1.11.0, DoH3 from v1.13.2)
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-82399 assigned