# CoreDNS vulnerabilities

Source: https://junglewise.ai/threats/vendors/coredns  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/coredns.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 13 vulnerabilities in CoreDNS: 0 in the last 7 days and 2 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86003, was published on 16 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 1 technology has a page of its own.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 2
- All time: 13 (1 critical, 0 exploited in the wild)

## About CoreDNS

A cloud-native DNS server written in Go that integrates with Kubernetes.

## Latest CoreDNS vulnerabilities

- [CVE-2026-86003: CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc) (high, CVSS 7.5, published 16 Sep 2026)
- [CVE-2026-82399: CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3) (high, CVSS 7.5, published 16 Sep 2026)
- [CVE-2026-62994: CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless) (low, CVSS 3.7, published 16 Jul 2026)
- [CVE-2026-62309: CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin) (high, CVSS 7.5, published 16 Jul 2026)
- [CVE-2026-62299: CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin) (medium, CVSS 5.3, published 16 Jul 2026)
- [CVE-2026-35579: CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports](https://junglewise.ai/threats/cve-2026-35579-coredns-tsig-authentication-bypass-in-grpc-quic-and-doh) (critical, CVSS 9.8, published 5 May 2026)
- [CVE-2026-33489: CoreDNS incorrect authorization in transfer plugin ACL selection](https://junglewise.ai/threats/cve-2026-33489-coredns-incorrect-authorization-in-transfer-plugin-acl-selection) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-33190: CoreDNS tsig authentication bypass in encrypted transports](https://junglewise.ai/threats/cve-2026-33190-coredns-tsig-authentication-bypass-in-encrypted-transports) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-32936: CoreDNS denial of service via oversized DoH GET requests](https://junglewise.ai/threats/cve-2026-32936-coredns-denial-of-service-via-oversized-doh-get-requests) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-32934: CoreDNS resource exhaustion in DNS-over-QUIC server](https://junglewise.ai/threats/cve-2026-32934-coredns-resource-exhaustion-in-dns-over-quic-server) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-26018: CoreDNS denial of service in loop detection plugin](https://junglewise.ai/threats/cve-2026-26018-coredns-denial-of-service-in-loop-detection-plugin) (high, CVSS 7.5, published 6 Mar 2026)
- [CVE-2026-26017: CoreDNS access control bypass via plugin execution order](https://junglewise.ai/threats/cve-2026-26017-coredns-access-control-bypass-via-plugin-execution-order) (high, CVSS 7.7, published 6 Mar 2026)
- [CVE-2023-30464: CoreDNS DNS cache poisoning via birthday attack](https://junglewise.ai/threats/cve-2023-30464-coredns-dns-cache-poisoning-via-birthday-attack) (low, CVSS 3.7, published 18 Sep 2024)

## Most severe CoreDNS vulnerabilities

- [CVE-2026-35579: CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports](https://junglewise.ai/threats/cve-2026-35579-coredns-tsig-authentication-bypass-in-grpc-quic-and-doh) (critical, CVSS 9.8, published 5 May 2026)
- [CVE-2026-26017: CoreDNS access control bypass via plugin execution order](https://junglewise.ai/threats/cve-2026-26017-coredns-access-control-bypass-via-plugin-execution-order) (high, CVSS 7.7, published 6 Mar 2026)
- [CVE-2026-26018: CoreDNS denial of service in loop detection plugin](https://junglewise.ai/threats/cve-2026-26018-coredns-denial-of-service-in-loop-detection-plugin) (high, CVSS 7.5, published 6 Mar 2026)
- [CVE-2026-32934: CoreDNS resource exhaustion in DNS-over-QUIC server](https://junglewise.ai/threats/cve-2026-32934-coredns-resource-exhaustion-in-dns-over-quic-server) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-82399: CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3) (high, CVSS 7.5, published 16 Sep 2026)
- [CVE-2026-32936: CoreDNS denial of service via oversized DoH GET requests](https://junglewise.ai/threats/cve-2026-32936-coredns-denial-of-service-via-oversized-doh-get-requests) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-33190: CoreDNS tsig authentication bypass in encrypted transports](https://junglewise.ai/threats/cve-2026-33190-coredns-tsig-authentication-bypass-in-encrypted-transports) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-86003: CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc) (high, CVSS 7.5, published 16 Sep 2026)
- [CVE-2026-33489: CoreDNS incorrect authorization in transfer plugin ACL selection](https://junglewise.ai/threats/cve-2026-33489-coredns-incorrect-authorization-in-transfer-plugin-acl-selection) (high, CVSS 7.5, published 5 May 2026)
- [CVE-2026-62309: CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin) (high, CVSS 7.5, published 16 Jul 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 2 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 2 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## CoreDNS technologies

- [CoreDNS](https://junglewise.ai/threats/technologies/coredns): 13 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "CoreDNS vulnerabilities", https://junglewise.ai/threats/vendors/coredns, 9 November 2026.