What’s Vulnerable › Products

coredns vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your coredns version is affected

Latest coredns vulnerabilities

• CVE-2026-86003 — CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP (CVSS 7.5)
• CVE-2026-82399 — CoreDNS: Unauthenticated memory exhaustion in custom transports (CVSS 7.5)
• CVE-2026-62994 — CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin (CVSS 3.7)
• CVE-2026-62309 — CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS (CVSS 7.5)
• CVE-2026-62299 — CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record (CVSS 5.3)
• CVE-2026-35579 — CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports (CVSS 9.8)
• CVE-2026-33489 — CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison (CVSS 7.5)
• CVE-2026-33190 — CoreDNS TSIG authentication bypass on encrypted DNS transports (CVSS 7.5)
• CVE-2026-32936 — CoreDNS DoH GET path missing size validation causes CPU and memory amplification (CVSS 7.5)
• CVE-2026-32934 — CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service (CVSS 7.5)
• CVE-2026-26018 — CoreDNS Loop Detection Denial of Service Vulnerability (CVSS 7.5)
• CVE-2026-26017 — CoreDNS ACL Bypass (CVSS 6.3)
• CVE-2025-68151 — CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages (CVSS 7.5)
• CVE-2025-58063 — CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion (CVSS 7.1)
• CVE-2025-47950 — CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification (CVSS 7.5)
• CVE-2023-30464 — (CVSS 7.5)
• CVE-2023-28452 — (CVSS 7.5)
• CVE-2022-2837 — (CVSS 6.1)
• CVE-2022-2835 — (CVSS 4.4)